Analysis
-
max time kernel
151s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 06:25
Static task
static1
Behavioral task
behavioral1
Sample
c7dc37f5c4f114e5bd38e9ea24be4b5e6c531f26c5195d599f07b281941454fa.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c7dc37f5c4f114e5bd38e9ea24be4b5e6c531f26c5195d599f07b281941454fa.exe
Resource
win10v2004-20220812-en
General
-
Target
c7dc37f5c4f114e5bd38e9ea24be4b5e6c531f26c5195d599f07b281941454fa.exe
-
Size
209KB
-
MD5
380551df606f98156ef8bb441307986d
-
SHA1
758fc286b0991a0b9593670a4c05359dca4db256
-
SHA256
c7dc37f5c4f114e5bd38e9ea24be4b5e6c531f26c5195d599f07b281941454fa
-
SHA512
49432a38222b32a773b51fe4ceebfb82952341ba473a4da00f108efdf20f2f6aad738e89f3ed8a689b22b2cd84b02888b67f26a9b36f8f0d244f9a0fc33b5b3d
-
SSDEEP
6144:PGFWiwdyS3VuP8ZpKoZyAWbA/Ubj5EbHT1oqiOqPle9m:3iwdy2IopKyW1MT1oqi7Sm
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1340 facebook.exe 1012 facebook.exe 1188 facebook.exe 340 facebook.exe 768 facebook.exe 1496 facebook.exe 688 facebook.exe 1844 facebook.exe 1632 facebook.exe 1728 facebook.exe 1528 facebook.exe 1580 facebook.exe 1164 facebook.exe 1576 facebook.exe 1992 facebook.exe 1252 facebook.exe 2004 facebook.exe 1416 facebook.exe 1496 facebook.exe 2072 facebook.exe 2144 facebook.exe 2216 facebook.exe 2288 facebook.exe 2360 facebook.exe 2432 facebook.exe 2504 facebook.exe 2576 facebook.exe 2652 facebook.exe 2724 facebook.exe 2796 facebook.exe 2868 facebook.exe 2940 facebook.exe 3012 facebook.exe 2080 facebook.exe 2240 facebook.exe 2596 facebook.exe 2804 facebook.exe 2964 facebook.exe 2304 facebook.exe 1564 facebook.exe 2524 facebook.exe 2548 facebook.exe 2604 facebook.exe 2660 facebook.exe 2708 facebook.exe 3064 facebook.exe 2344 facebook.exe 3012 facebook.exe 688 facebook.exe 2948 facebook.exe 2184 facebook.exe 1740 facebook.exe 1276 facebook.exe 1516 facebook.exe 1648 facebook.exe 1012 facebook.exe 1380 facebook.exe 2108 facebook.exe 2524 facebook.exe 1476 facebook.exe 2372 facebook.exe 2044 facebook.exe 2832 facebook.exe 2032 facebook.exe -
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 1340 set thread context of 1012 1340 facebook.exe 30 PID 1012 set thread context of 1188 1012 facebook.exe 32 PID 1188 set thread context of 340 1188 facebook.exe 34 PID 340 set thread context of 768 340 facebook.exe 36 PID 768 set thread context of 1496 768 facebook.exe 38 PID 1496 set thread context of 688 1496 facebook.exe 40 PID 688 set thread context of 1844 688 facebook.exe 42 PID 1844 set thread context of 1632 1844 facebook.exe 44 PID 1632 set thread context of 1728 1632 facebook.exe 46 PID 1728 set thread context of 1528 1728 facebook.exe 48 PID 1528 set thread context of 1580 1528 facebook.exe 50 PID 1580 set thread context of 1164 1580 facebook.exe 52 PID 1164 set thread context of 1576 1164 facebook.exe 54 PID 1576 set thread context of 1992 1576 facebook.exe 56 PID 1992 set thread context of 1252 1992 facebook.exe 58 PID 1252 set thread context of 2004 1252 facebook.exe 60 PID 2004 set thread context of 1416 2004 facebook.exe 62 PID 1416 set thread context of 1496 1416 facebook.exe 64 PID 1496 set thread context of 2072 1496 facebook.exe 66 PID 2072 set thread context of 2144 2072 facebook.exe 68 PID 2144 set thread context of 2216 2144 facebook.exe 70 PID 2216 set thread context of 2288 2216 facebook.exe 72 PID 2288 set thread context of 2360 2288 facebook.exe 74 PID 2360 set thread context of 2432 2360 facebook.exe 76 PID 2432 set thread context of 2504 2432 facebook.exe 78 PID 2504 set thread context of 2576 2504 facebook.exe 80 PID 2576 set thread context of 2652 2576 facebook.exe 82 PID 2652 set thread context of 2724 2652 facebook.exe 84 PID 2724 set thread context of 2796 2724 facebook.exe 86 PID 2796 set thread context of 2868 2796 facebook.exe 88 PID 2868 set thread context of 2940 2868 facebook.exe 90 PID 2940 set thread context of 3012 2940 facebook.exe 92 PID 3012 set thread context of 2080 3012 facebook.exe 94 PID 2080 set thread context of 2240 2080 facebook.exe 96 PID 2240 set thread context of 2596 2240 facebook.exe 98 PID 2596 set thread context of 2804 2596 facebook.exe 100 PID 2804 set thread context of 2964 2804 facebook.exe 102 PID 2964 set thread context of 2304 2964 facebook.exe 104 PID 2304 set thread context of 1564 2304 facebook.exe 106 PID 1564 set thread context of 2524 1564 facebook.exe 109 PID 2524 set thread context of 2548 2524 facebook.exe 111 PID 2548 set thread context of 2604 2548 facebook.exe 113 PID 2604 set thread context of 2660 2604 facebook.exe 115 PID 2660 set thread context of 2708 2660 facebook.exe 117 PID 2708 set thread context of 3064 2708 facebook.exe 119 PID 3064 set thread context of 2344 3064 facebook.exe 121 PID 2344 set thread context of 3012 2344 facebook.exe 123 PID 3012 set thread context of 688 3012 facebook.exe 125 PID 688 set thread context of 2948 688 facebook.exe 127 PID 2948 set thread context of 2184 2948 facebook.exe 129 PID 2184 set thread context of 1740 2184 facebook.exe 131 PID 1740 set thread context of 1276 1740 facebook.exe 133 PID 1276 set thread context of 1516 1276 facebook.exe 135 PID 1516 set thread context of 1648 1516 facebook.exe 137 PID 1648 set thread context of 1012 1648 facebook.exe 139 PID 1012 set thread context of 1380 1012 facebook.exe 141 PID 1380 set thread context of 2108 1380 facebook.exe 143 PID 2108 set thread context of 2524 2108 facebook.exe 145 PID 2524 set thread context of 1476 2524 facebook.exe 147 PID 1476 set thread context of 2372 1476 facebook.exe 149 PID 2372 set thread context of 2044 2372 facebook.exe 151 PID 2044 set thread context of 2832 2044 facebook.exe 152 PID 2832 set thread context of 2032 2832 facebook.exe 155 PID 2032 set thread context of 2744 2032 facebook.exe 157 -
Drops file in Windows directory 24 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new facebook.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new facebook.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new facebook.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new facebook.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new facebook.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new facebook.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new facebook.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new facebook.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new facebook.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new facebook.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new facebook.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new facebook.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new facebook.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new facebook.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new facebook.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new facebook.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new facebook.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new facebook.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new facebook.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new facebook.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new facebook.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new facebook.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new facebook.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new facebook.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1340 facebook.exe Token: SeDebugPrivilege 1012 facebook.exe Token: SeDebugPrivilege 1188 facebook.exe Token: SeDebugPrivilege 340 facebook.exe Token: SeDebugPrivilege 768 facebook.exe Token: SeDebugPrivilege 1496 facebook.exe Token: SeDebugPrivilege 688 facebook.exe Token: SeDebugPrivilege 1844 facebook.exe Token: SeDebugPrivilege 1632 facebook.exe Token: SeDebugPrivilege 1728 facebook.exe Token: SeDebugPrivilege 1528 facebook.exe Token: SeDebugPrivilege 1580 facebook.exe Token: SeDebugPrivilege 1164 facebook.exe Token: SeDebugPrivilege 1576 facebook.exe Token: SeDebugPrivilege 1992 facebook.exe Token: SeDebugPrivilege 1252 facebook.exe Token: SeDebugPrivilege 2004 facebook.exe Token: SeDebugPrivilege 1416 facebook.exe Token: SeDebugPrivilege 1496 facebook.exe Token: SeDebugPrivilege 2072 facebook.exe Token: SeDebugPrivilege 2144 facebook.exe Token: SeDebugPrivilege 2216 facebook.exe Token: SeDebugPrivilege 2288 facebook.exe Token: SeDebugPrivilege 2360 facebook.exe Token: SeDebugPrivilege 2432 facebook.exe Token: SeDebugPrivilege 2504 facebook.exe Token: SeDebugPrivilege 2576 facebook.exe Token: SeDebugPrivilege 2652 facebook.exe Token: SeDebugPrivilege 2724 facebook.exe Token: SeDebugPrivilege 2796 facebook.exe Token: SeDebugPrivilege 2868 facebook.exe Token: SeDebugPrivilege 2940 facebook.exe Token: SeDebugPrivilege 3012 facebook.exe Token: SeDebugPrivilege 2080 facebook.exe Token: SeDebugPrivilege 2240 facebook.exe Token: SeDebugPrivilege 2596 facebook.exe Token: SeDebugPrivilege 2804 facebook.exe Token: SeDebugPrivilege 2964 facebook.exe Token: SeDebugPrivilege 2304 facebook.exe Token: SeDebugPrivilege 1564 facebook.exe Token: SeDebugPrivilege 2524 facebook.exe Token: SeDebugPrivilege 2548 facebook.exe Token: SeDebugPrivilege 2604 facebook.exe Token: SeDebugPrivilege 2660 facebook.exe Token: SeDebugPrivilege 2708 facebook.exe Token: SeDebugPrivilege 3064 facebook.exe Token: SeDebugPrivilege 2344 facebook.exe Token: SeDebugPrivilege 3012 facebook.exe Token: SeDebugPrivilege 688 facebook.exe Token: SeDebugPrivilege 2948 facebook.exe Token: SeDebugPrivilege 2184 facebook.exe Token: SeDebugPrivilege 1740 facebook.exe Token: SeDebugPrivilege 1276 facebook.exe Token: SeDebugPrivilege 1516 facebook.exe Token: SeDebugPrivilege 1648 facebook.exe Token: SeDebugPrivilege 1012 facebook.exe Token: SeDebugPrivilege 1380 facebook.exe Token: SeDebugPrivilege 2108 facebook.exe Token: SeDebugPrivilege 2524 facebook.exe Token: SeDebugPrivilege 1476 facebook.exe Token: SeDebugPrivilege 2372 facebook.exe Token: SeDebugPrivilege 2044 facebook.exe Token: SeDebugPrivilege 2832 facebook.exe Token: SeDebugPrivilege 2032 facebook.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 916 DllHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1500 wrote to memory of 1340 1500 c7dc37f5c4f114e5bd38e9ea24be4b5e6c531f26c5195d599f07b281941454fa.exe 28 PID 1500 wrote to memory of 1340 1500 c7dc37f5c4f114e5bd38e9ea24be4b5e6c531f26c5195d599f07b281941454fa.exe 28 PID 1500 wrote to memory of 1340 1500 c7dc37f5c4f114e5bd38e9ea24be4b5e6c531f26c5195d599f07b281941454fa.exe 28 PID 1500 wrote to memory of 1340 1500 c7dc37f5c4f114e5bd38e9ea24be4b5e6c531f26c5195d599f07b281941454fa.exe 28 PID 1340 wrote to memory of 1968 1340 facebook.exe 29 PID 1340 wrote to memory of 1968 1340 facebook.exe 29 PID 1340 wrote to memory of 1968 1340 facebook.exe 29 PID 1340 wrote to memory of 1012 1340 facebook.exe 30 PID 1340 wrote to memory of 1012 1340 facebook.exe 30 PID 1340 wrote to memory of 1012 1340 facebook.exe 30 PID 1340 wrote to memory of 1012 1340 facebook.exe 30 PID 1340 wrote to memory of 1012 1340 facebook.exe 30 PID 1340 wrote to memory of 1012 1340 facebook.exe 30 PID 1012 wrote to memory of 1708 1012 facebook.exe 31 PID 1012 wrote to memory of 1708 1012 facebook.exe 31 PID 1012 wrote to memory of 1708 1012 facebook.exe 31 PID 1012 wrote to memory of 1188 1012 facebook.exe 32 PID 1012 wrote to memory of 1188 1012 facebook.exe 32 PID 1012 wrote to memory of 1188 1012 facebook.exe 32 PID 1012 wrote to memory of 1188 1012 facebook.exe 32 PID 1012 wrote to memory of 1188 1012 facebook.exe 32 PID 1012 wrote to memory of 1188 1012 facebook.exe 32 PID 1188 wrote to memory of 1736 1188 facebook.exe 33 PID 1188 wrote to memory of 1736 1188 facebook.exe 33 PID 1188 wrote to memory of 1736 1188 facebook.exe 33 PID 1188 wrote to memory of 340 1188 facebook.exe 34 PID 1188 wrote to memory of 340 1188 facebook.exe 34 PID 1188 wrote to memory of 340 1188 facebook.exe 34 PID 1188 wrote to memory of 340 1188 facebook.exe 34 PID 1188 wrote to memory of 340 1188 facebook.exe 34 PID 1188 wrote to memory of 340 1188 facebook.exe 34 PID 340 wrote to memory of 1772 340 facebook.exe 35 PID 340 wrote to memory of 1772 340 facebook.exe 35 PID 340 wrote to memory of 1772 340 facebook.exe 35 PID 340 wrote to memory of 768 340 facebook.exe 36 PID 340 wrote to memory of 768 340 facebook.exe 36 PID 340 wrote to memory of 768 340 facebook.exe 36 PID 340 wrote to memory of 768 340 facebook.exe 36 PID 340 wrote to memory of 768 340 facebook.exe 36 PID 340 wrote to memory of 768 340 facebook.exe 36 PID 768 wrote to memory of 1392 768 facebook.exe 37 PID 768 wrote to memory of 1392 768 facebook.exe 37 PID 768 wrote to memory of 1392 768 facebook.exe 37 PID 768 wrote to memory of 1496 768 facebook.exe 38 PID 768 wrote to memory of 1496 768 facebook.exe 38 PID 768 wrote to memory of 1496 768 facebook.exe 38 PID 768 wrote to memory of 1496 768 facebook.exe 38 PID 768 wrote to memory of 1496 768 facebook.exe 38 PID 768 wrote to memory of 1496 768 facebook.exe 38 PID 1496 wrote to memory of 1000 1496 facebook.exe 39 PID 1496 wrote to memory of 1000 1496 facebook.exe 39 PID 1496 wrote to memory of 1000 1496 facebook.exe 39 PID 1496 wrote to memory of 688 1496 facebook.exe 40 PID 1496 wrote to memory of 688 1496 facebook.exe 40 PID 1496 wrote to memory of 688 1496 facebook.exe 40 PID 1496 wrote to memory of 688 1496 facebook.exe 40 PID 1496 wrote to memory of 688 1496 facebook.exe 40 PID 1496 wrote to memory of 688 1496 facebook.exe 40 PID 688 wrote to memory of 1628 688 facebook.exe 41 PID 688 wrote to memory of 1628 688 facebook.exe 41 PID 688 wrote to memory of 1628 688 facebook.exe 41 PID 688 wrote to memory of 1844 688 facebook.exe 42 PID 688 wrote to memory of 1844 688 facebook.exe 42 PID 688 wrote to memory of 1844 688 facebook.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7dc37f5c4f114e5bd38e9ea24be4b5e6c531f26c5195d599f07b281941454fa.exe"C:\Users\Admin\AppData\Local\Temp\c7dc37f5c4f114e5bd38e9ea24be4b5e6c531f26c5195d599f07b281941454fa.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\facebook.exe"C:\facebook.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\facebook.exeC:\facebook.exe3⤵PID:1968
-
-
C:\facebook.exeC:\facebook.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\facebook.exeC:\facebook.exe4⤵PID:1708
-
-
C:\facebook.exeC:\facebook.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\facebook.exeC:\facebook.exe5⤵PID:1736
-
-
C:\facebook.exeC:\facebook.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:340 -
C:\facebook.exeC:\facebook.exe6⤵PID:1772
-
-
C:\facebook.exeC:\facebook.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:768 -
C:\facebook.exeC:\facebook.exe7⤵PID:1392
-
-
C:\facebook.exeC:\facebook.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\facebook.exeC:\facebook.exe8⤵PID:1000
-
-
C:\facebook.exeC:\facebook.exe8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:688 -
C:\facebook.exeC:\facebook.exe9⤵PID:1628
-
-
C:\facebook.exeC:\facebook.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1844 -
C:\facebook.exeC:\facebook.exe10⤵PID:1940
-
-
C:\facebook.exeC:\facebook.exe10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1632 -
C:\facebook.exeC:\facebook.exe11⤵PID:836
-
-
C:\facebook.exeC:\facebook.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1728 -
C:\facebook.exeC:\facebook.exe12⤵PID:268
-
-
C:\facebook.exeC:\facebook.exe12⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1528 -
C:\facebook.exeC:\facebook.exe13⤵PID:1972
-
-
C:\facebook.exeC:\facebook.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1580 -
C:\facebook.exeC:\facebook.exe14⤵PID:760
-
-
C:\facebook.exeC:\facebook.exe14⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1164 -
C:\facebook.exeC:\facebook.exe15⤵PID:636
-
-
C:\facebook.exeC:\facebook.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1576 -
C:\facebook.exeC:\facebook.exe16⤵PID:1928
-
-
C:\facebook.exeC:\facebook.exe16⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1992 -
C:\facebook.exeC:\facebook.exe17⤵PID:2008
-
-
C:\facebook.exeC:\facebook.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1252 -
C:\facebook.exeC:\facebook.exe18⤵PID:1032
-
-
C:\facebook.exeC:\facebook.exe18⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2004 -
C:\facebook.exeC:\facebook.exe19⤵PID:1052
-
-
C:\facebook.exeC:\facebook.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1416 -
C:\facebook.exeC:\facebook.exe20⤵PID:1144
-
-
C:\facebook.exeC:\facebook.exe20⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1496 -
C:\facebook.exeC:\facebook.exe21⤵PID:2064
-
-
C:\facebook.exeC:\facebook.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2072 -
C:\facebook.exeC:\facebook.exe22⤵PID:2136
-
-
C:\facebook.exeC:\facebook.exe22⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2144 -
C:\facebook.exeC:\facebook.exe23⤵PID:2208
-
-
C:\facebook.exeC:\facebook.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2216 -
C:\facebook.exeC:\facebook.exe24⤵PID:2280
-
-
C:\facebook.exeC:\facebook.exe24⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2288 -
C:\facebook.exeC:\facebook.exe25⤵PID:2352
-
-
C:\facebook.exeC:\facebook.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2360 -
C:\facebook.exeC:\facebook.exe26⤵PID:2424
-
-
C:\facebook.exeC:\facebook.exe26⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2432 -
C:\facebook.exeC:\facebook.exe27⤵PID:2496
-
-
C:\facebook.exeC:\facebook.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2504 -
C:\facebook.exeC:\facebook.exe28⤵PID:2568
-
-
C:\facebook.exeC:\facebook.exe28⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2576 -
C:\facebook.exeC:\facebook.exe29⤵PID:2644
-
-
C:\facebook.exeC:\facebook.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2652 -
C:\facebook.exeC:\facebook.exe30⤵PID:2716
-
-
C:\facebook.exeC:\facebook.exe30⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2724 -
C:\facebook.exeC:\facebook.exe31⤵PID:2788
-
-
C:\facebook.exeC:\facebook.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2796 -
C:\facebook.exeC:\facebook.exe32⤵PID:2860
-
-
C:\facebook.exeC:\facebook.exe32⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2868 -
C:\facebook.exeC:\facebook.exe33⤵PID:2932
-
-
C:\facebook.exeC:\facebook.exe33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2940 -
C:\facebook.exeC:\facebook.exe34⤵PID:3004
-
-
C:\facebook.exeC:\facebook.exe34⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3012 -
C:\facebook.exeC:\facebook.exe35⤵PID:1120
-
-
C:\facebook.exeC:\facebook.exe35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2080 -
C:\facebook.exeC:\facebook.exe36⤵PID:2232
-
-
C:\facebook.exeC:\facebook.exe36⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2240 -
C:\facebook.exeC:\facebook.exe37⤵PID:2588
-
-
C:\facebook.exeC:\facebook.exe37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2596 -
C:\facebook.exeC:\facebook.exe38⤵PID:2748
-
-
C:\facebook.exeC:\facebook.exe38⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2804 -
C:\facebook.exeC:\facebook.exe39⤵PID:2960
-
-
C:\facebook.exeC:\facebook.exe39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2964 -
C:\facebook.exeC:\facebook.exe40⤵PID:2296
-
-
C:\facebook.exeC:\facebook.exe40⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2304 -
C:\facebook.exeC:\facebook.exe41⤵PID:2404
-
-
C:\facebook.exeC:\facebook.exe41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1564 -
C:\facebook.exeC:\facebook.exe42⤵PID:1832
-
-
C:\facebook.exeC:\facebook.exe42⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2524 -
C:\facebook.exeC:\facebook.exe43⤵PID:2536
-
-
C:\facebook.exeC:\facebook.exe43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2548 -
C:\facebook.exeC:\facebook.exe44⤵PID:2556
-
-
C:\facebook.exeC:\facebook.exe44⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2604 -
C:\facebook.exeC:\facebook.exe45⤵PID:2692
-
-
C:\facebook.exeC:\facebook.exe45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2660 -
C:\facebook.exeC:\facebook.exe46⤵PID:2176
-
-
C:\facebook.exeC:\facebook.exe46⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2708 -
C:\facebook.exeC:\facebook.exe47⤵PID:2984
-
-
C:\facebook.exeC:\facebook.exe47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3064 -
C:\facebook.exeC:\facebook.exe48⤵PID:2240
-
-
C:\facebook.exeC:\facebook.exe48⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2344 -
C:\facebook.exeC:\facebook.exe49⤵PID:2868
-
-
C:\facebook.exeC:\facebook.exe49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3012 -
C:\facebook.exeC:\facebook.exe50⤵PID:2820
-
-
C:\facebook.exeC:\facebook.exe50⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:688 -
C:\facebook.exeC:\facebook.exe51⤵PID:2092
-
-
C:\facebook.exeC:\facebook.exe51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2948 -
C:\facebook.exeC:\facebook.exe52⤵PID:2996
-
-
C:\facebook.exeC:\facebook.exe52⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2184 -
C:\facebook.exeC:\facebook.exe53⤵PID:2204
-
-
C:\facebook.exeC:\facebook.exe53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1740 -
C:\facebook.exeC:\facebook.exe54⤵PID:2464
-
-
C:\facebook.exeC:\facebook.exe54⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1276 -
C:\facebook.exeC:\facebook.exe55⤵PID:876
-
-
C:\facebook.exeC:\facebook.exe55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1516 -
C:\facebook.exeC:\facebook.exe56⤵PID:1188
-
-
C:\facebook.exeC:\facebook.exe56⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1648 -
C:\facebook.exeC:\facebook.exe57⤵PID:1632
-
-
C:\facebook.exeC:\facebook.exe57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1012 -
C:\facebook.exeC:\facebook.exe58⤵PID:2308
-
-
C:\facebook.exeC:\facebook.exe58⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1380 -
C:\facebook.exeC:\facebook.exe59⤵PID:2180
-
-
C:\facebook.exeC:\facebook.exe59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2108 -
C:\facebook.exeC:\facebook.exe60⤵PID:2460
-
-
C:\facebook.exeC:\facebook.exe60⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2524 -
C:\facebook.exeC:\facebook.exe61⤵PID:2584
-
-
C:\facebook.exeC:\facebook.exe61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1476 -
C:\facebook.exeC:\facebook.exe62⤵PID:2912
-
-
C:\facebook.exeC:\facebook.exe62⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2372 -
C:\facebook.exeC:\facebook.exe63⤵PID:2660
-
-
C:\facebook.exeC:\facebook.exe63⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2044 -
C:\facebook.exeC:\facebook.exe64⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2832 -
C:\facebook.exeC:\facebook.exe65⤵PID:2940
-
-
C:\facebook.exeC:\facebook.exe65⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2032 -
C:\facebook.exeC:\facebook.exe66⤵PID:2884
-
-
C:\facebook.exeC:\facebook.exe66⤵PID:2744
-
C:\facebook.exeC:\facebook.exe67⤵PID:2392
-
C:\facebook.exeC:\facebook.exe68⤵PID:2452
-
-
C:\facebook.exeC:\facebook.exe68⤵PID:932
-
C:\facebook.exeC:\facebook.exe69⤵PID:1492
-
C:\facebook.exeC:\facebook.exe70⤵PID:1712
-
-
C:\facebook.exeC:\facebook.exe70⤵PID:856
-
C:\facebook.exeC:\facebook.exe71⤵PID:2124
-
-
C:\facebook.exeC:\facebook.exe71⤵PID:844
-
C:\facebook.exeC:\facebook.exe72⤵PID:1140
-
-
C:\facebook.exeC:\facebook.exe72⤵PID:1900
-
C:\facebook.exeC:\facebook.exe73⤵PID:832
-
-
C:\facebook.exeC:\facebook.exe73⤵PID:1576
-
C:\facebook.exeC:\facebook.exe74⤵PID:2144
-
-
C:\facebook.exeC:\facebook.exe74⤵PID:432
-
C:\facebook.exeC:\facebook.exe75⤵PID:2336
-
-
C:\facebook.exeC:\facebook.exe75⤵PID:2476
-
C:\facebook.exeC:\facebook.exe76⤵PID:2528
-
-
C:\facebook.exeC:\facebook.exe76⤵PID:1564
-
C:\facebook.exeC:\facebook.exe77⤵PID:704
-
-
C:\facebook.exeC:\facebook.exe77⤵PID:2432
-
C:\facebook.exeC:\facebook.exe78⤵PID:240
-
-
C:\facebook.exeC:\facebook.exe78⤵PID:2920
-
C:\facebook.exeC:\facebook.exe79⤵PID:2624
-
-
C:\facebook.exeC:\facebook.exe79⤵PID:2712
-
C:\facebook.exeC:\facebook.exe80⤵PID:2800
-
C:\facebook.exeC:\facebook.exe81⤵PID:2012
-
-
C:\facebook.exeC:\facebook.exe81⤵PID:1752
-
C:\facebook.exeC:\facebook.exe82⤵PID:2876
-
-
C:\facebook.exeC:\facebook.exe82⤵PID:3020
-
C:\facebook.exeC:\facebook.exe83⤵PID:2312
-
-
C:\facebook.exeC:\facebook.exe83⤵PID:3036
-
C:\facebook.exeC:\facebook.exe84⤵PID:2196
-
-
C:\facebook.exeC:\facebook.exe84⤵PID:1776
-
C:\facebook.exeC:\facebook.exe85⤵PID:932
-
-
C:\facebook.exeC:\facebook.exe85⤵PID:2020
-
C:\facebook.exeC:\facebook.exe86⤵PID:1528
-
-
C:\facebook.exeC:\facebook.exe86⤵PID:1368
-
C:\facebook.exeC:\facebook.exe87⤵PID:1152
-
-
C:\facebook.exeC:\facebook.exe87⤵PID:1992
-
C:\facebook.exeC:\facebook.exe88⤵PID:1536
-
-
C:\facebook.exeC:\facebook.exe88⤵PID:2472
-
C:\facebook.exeC:\facebook.exe89⤵PID:1608
-
-
C:\facebook.exeC:\facebook.exe89⤵PID:2488
-
C:\facebook.exeC:\facebook.exe90⤵PID:2616
-
-
C:\facebook.exeC:\facebook.exe90⤵PID:2060
-
C:\facebook.exeC:\facebook.exe91⤵PID:2504
-
-
C:\facebook.exeC:\facebook.exe91⤵PID:2540
-
C:\facebook.exeC:\facebook.exe92⤵PID:2840
-
-
C:\facebook.exeC:\facebook.exe92⤵PID:2480
-
C:\facebook.exeC:\facebook.exe93⤵PID:2688
-
-
C:\facebook.exeC:\facebook.exe93⤵PID:3000
-
C:\facebook.exeC:\facebook.exe94⤵PID:2848
-
-
C:\facebook.exeC:\facebook.exe94⤵PID:2928
-
C:\facebook.exeC:\facebook.exe95⤵PID:2656
-
-
C:\facebook.exeC:\facebook.exe95⤵PID:2872
-
C:\facebook.exeC:\facebook.exe96⤵PID:2032
-
-
C:\facebook.exeC:\facebook.exe96⤵PID:3028
-
C:\facebook.exeC:\facebook.exe97⤵PID:2128
-
-
C:\facebook.exeC:\facebook.exe97⤵PID:2804
-
C:\facebook.exeC:\facebook.exe98⤵PID:2924
-
-
C:\facebook.exeC:\facebook.exe98⤵PID:2744
-
C:\facebook.exeC:\facebook.exe99⤵PID:1580
-
-
C:\facebook.exeC:\facebook.exe99⤵PID:1932
-
C:\facebook.exeC:\facebook.exe100⤵PID:1492
-
-
C:\facebook.exeC:\facebook.exe100⤵PID:1276
-
C:\facebook.exeC:\facebook.exe101⤵PID:1368
-
-
C:\facebook.exeC:\facebook.exe101⤵PID:1416
-
C:\facebook.exeC:\facebook.exe102⤵PID:2388
-
-
C:\facebook.exeC:\facebook.exe102⤵PID:1012
-
C:\facebook.exeC:\facebook.exe103⤵PID:2436
-
-
C:\facebook.exeC:\facebook.exe103⤵PID:2320
-
C:\facebook.exeC:\facebook.exe104⤵PID:1124
-
-
C:\facebook.exeC:\facebook.exe104⤵PID:2776
-
C:\facebook.exeC:\facebook.exe105⤵PID:2672
-
C:\facebook.exeC:\facebook.exe106⤵PID:2632
-
-
C:\facebook.exeC:\facebook.exe106⤵PID:2372
-
C:\facebook.exeC:\facebook.exe107⤵PID:2856
-
-
C:\facebook.exeC:\facebook.exe107⤵PID:3000
-
C:\facebook.exeC:\facebook.exe108⤵PID:2608
-
-
C:\facebook.exeC:\facebook.exe108⤵PID:2816
-
C:\facebook.exeC:\facebook.exe109⤵PID:2088
-
-
C:\facebook.exeC:\facebook.exe109⤵PID:2152
-
C:\facebook.exeC:\facebook.exe110⤵PID:3036
-
-
C:\facebook.exeC:\facebook.exe110⤵PID:1376
-
C:\facebook.exeC:\facebook.exe111⤵PID:1088
-
-
C:\facebook.exeC:\facebook.exe111⤵PID:472
-
C:\facebook.exeC:\facebook.exe112⤵PID:2328
-
-
C:\facebook.exeC:\facebook.exe112⤵PID:1728
-
C:\facebook.exeC:\facebook.exe113⤵PID:1584
-
-
C:\facebook.exeC:\facebook.exe113⤵PID:1276
-
C:\facebook.exeC:\facebook.exe114⤵PID:2148
-
-
C:\facebook.exeC:\facebook.exe114⤵PID:2516
-
C:\facebook.exeC:\facebook.exe115⤵PID:1012
-
-
C:\facebook.exeC:\facebook.exe115⤵PID:1112
-
C:\facebook.exeC:\facebook.exe116⤵PID:2844
-
-
C:\facebook.exeC:\facebook.exe116⤵PID:2376
-
C:\facebook.exeC:\facebook.exe117⤵PID:2044
-
-
C:\facebook.exeC:\facebook.exe117⤵PID:3048
-
C:\facebook.exeC:\facebook.exe118⤵PID:2976
-
-
C:\facebook.exeC:\facebook.exe118⤵PID:3064
-
C:\facebook.exeC:\facebook.exe119⤵PID:2968
-
-
C:\facebook.exeC:\facebook.exe119⤵PID:2160
-
C:\facebook.exeC:\facebook.exe120⤵PID:2808
-
-
C:\facebook.exeC:\facebook.exe120⤵PID:3012
-
C:\facebook.exeC:\facebook.exe121⤵PID:2804
-
-
C:\facebook.exeC:\facebook.exe121⤵PID:2152
-
C:\facebook.exeC:\facebook.exe122⤵PID:1376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-