Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 05:28
Static task
static1
Behavioral task
behavioral1
Sample
cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe
-
Size
130KB
-
MD5
671fa6252373e4be5b9f6cfd362d9975
-
SHA1
fcc2b6b69cad6d4ed62cd17c7a9006167d2f9306
-
SHA256
cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a
-
SHA512
eae7574f64525b2380c2693a43c1d992a6f4fbafa2c8bba43bb59f799e0e2e02eb8d52ad67a86dd74d05843f2e286baa86b80882b0405b60d8094b4cd2a33df8
-
SSDEEP
3072:3eVlG7NrwzA+Wl6tYFFKYKkIXYmULqG9tpzuyEBu3Ie1NFKJM8Yp:3eVc8zA+Wl+AKfLYmUnZfEBu4e1NGC
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OneDriveSetupOneDrive = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe" cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\MicrosoftOneDriveSetup26962 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe" cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\ntdll.dll.dll cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\System\Ole DB\en-US\Systemsqlxmlx.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Google\Update\Install\{0D3B55D5-C891-4ABD-ADA8-7B4746A87555}\miniinstallerInstaller.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\Studiovstoee.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Windows Mail\SystemWABMIG10.0.19041.1110.160101.0800.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfigSystem.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Common Files\System\WAB32WAB32res.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Internet Explorer\en-US\scannerprocesses.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{18F127B1-7EA9-4BC3-9FD3-434ABBAC765F}\processesSetup.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\miniinstallerChrome.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EdgeSystem.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AdobeAcrobat19.10.20064.310990.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Common Files\System\msadc\msadceSystem.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevicesWindows.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\msdasqlrWindows.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Common Files\System\msadc\en-US\msaddsrmsdaremr.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Windows NT\Accessories\en-US\scannerItSoftA2.4.5600.0.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\win_x64\scannerwidevinecdm.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Proxypwahelper.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagementMsuProvider10.0.19041.1.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Windows Media Player\en-US\SoftWarescanner.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\MicrosoftVisual.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Google\Update\Updateprocesses.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\NPPDF32scanner.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SystemPresentationBuildTasks.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUIVSTOLoaderUI10.0.60828.0.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\scannerscanner.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\MicrosoftSoftWare.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Windows NT\Accessories\en-US\SystemWORDPAD10.0.19041.1.160101.0800.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Google\Update\1.3.36.71\ResourceUpdate.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\VisualMicrosoft.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\StudioTools.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Windows Media Player\en-US\scannerSoftWare2.4.5600.0.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\Widevinelibcef.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\scannerAdobe.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservicescanner.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Windows Media Player\en-US\scannerprocesses.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\ToolsTools.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Google\Update\Install\{0D3B55D5-C891-4ABD-ADA8-7B4746A87555}\ChromeSoftWare.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\win_x64\processesSoftWare.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\processesAdobe.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jauregScheduler2.8.66.17.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Windows Mail\WindowsSoftWare.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Internet Explorer\en-US\ItSoftAprocesses.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\UpdateMicrosoft.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\win_x64\Contentwidevinecdm.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\VisualItSoftA2.4.5600.0.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setupEdge.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\ExplorerItSoftA.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\scannerItSoftA.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Internet Explorer\en-US\ExplorerHMMAPI.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Common Files\System\en-US\processesItSoftA.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\ExplorerInternet.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\MicrosoftSystem10.0.19041.1.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Linkelevationserviceexe1.7.20210408.6.53026.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\scannerprocesses2.4.5600.0.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Windows NT\Accessories\WindowsWindows.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Google\Update\GoogleUpdateGoogle.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\MicrosoftTools9.0.30729.7079.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\SoftWareItSoftA.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{18F127B1-7EA9-4BC3-9FD3-434ABBAC765F}\SoftWarescanner.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Windows Media Player\en-US\WMPNSSCImpvis.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\OperatingItSoftA.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\pdf417pmpqrcodepmp3.6.18220.0.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ClassicMicrosoft.exe cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe 2496 cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe"C:\Users\Admin\AppData\Local\Temp\cdd9d09485ec69f08813490e25cd95a0d1299869a3149144794e3d8ad78c958a.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2496