Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
276s -
max time network
336s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 13:45
Static task
static1
Behavioral task
behavioral1
Sample
6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe
Resource
win10v2004-20220812-en
General
-
Target
6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe
-
Size
148KB
-
MD5
0541203ba4f1531c267f2df60d0a7994
-
SHA1
918359784ca7a521fd18d4b8a0df965335a04db1
-
SHA256
6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38
-
SHA512
e09dd3d00a4dcb1f3581c15c937ac5e819c20c5c327b3f5f1bd16b5b78e6d2ee89a05060b5317c139a7b6a48cdb14e0a520b64d500d2b1209528b9795a6fb4d9
-
SSDEEP
768:tWEEpO23DwVKrJLcdIFN+y3C6mTGep2UZEccJAPfTYolQ7eB8pGIy0O8y1ozz7yn:wjUiK8N+yS6mQQSUIXryCSwOy0R
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 560 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 760 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 868 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1244 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1044 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1872 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1008 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 936 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1508 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1868 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1320 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 548 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 964 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1592 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1916 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1304 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1836 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1820 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1520 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 828 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1792 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1668 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 936 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 696 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1268 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 900 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1796 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 560 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1920 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1372 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1768 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1256 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 896 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1936 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 508 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1280 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1436 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 2024 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1736 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 2012 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1596 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1116 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 560 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1720 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1372 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1768 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1580 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1676 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 872 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1512 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1064 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1536 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1744 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1736 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 2012 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 548 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1116 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1364 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1820 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 432 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 828 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1940 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1508 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe Token: SeDebugPrivilege 1760 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 560 wrote to memory of 760 560 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 28 PID 560 wrote to memory of 760 560 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 28 PID 560 wrote to memory of 760 560 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 28 PID 760 wrote to memory of 868 760 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 29 PID 760 wrote to memory of 868 760 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 29 PID 760 wrote to memory of 868 760 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 29 PID 868 wrote to memory of 1244 868 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 30 PID 868 wrote to memory of 1244 868 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 30 PID 868 wrote to memory of 1244 868 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 30 PID 1244 wrote to memory of 1044 1244 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 31 PID 1244 wrote to memory of 1044 1244 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 31 PID 1244 wrote to memory of 1044 1244 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 31 PID 1044 wrote to memory of 1872 1044 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 32 PID 1044 wrote to memory of 1872 1044 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 32 PID 1044 wrote to memory of 1872 1044 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 32 PID 1872 wrote to memory of 1008 1872 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 33 PID 1872 wrote to memory of 1008 1872 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 33 PID 1872 wrote to memory of 1008 1872 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 33 PID 1008 wrote to memory of 936 1008 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 34 PID 1008 wrote to memory of 936 1008 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 34 PID 1008 wrote to memory of 936 1008 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 34 PID 936 wrote to memory of 1508 936 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 35 PID 936 wrote to memory of 1508 936 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 35 PID 936 wrote to memory of 1508 936 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 35 PID 1508 wrote to memory of 1868 1508 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 36 PID 1508 wrote to memory of 1868 1508 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 36 PID 1508 wrote to memory of 1868 1508 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 36 PID 1868 wrote to memory of 1320 1868 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 37 PID 1868 wrote to memory of 1320 1868 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 37 PID 1868 wrote to memory of 1320 1868 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 37 PID 1320 wrote to memory of 548 1320 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 38 PID 1320 wrote to memory of 548 1320 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 38 PID 1320 wrote to memory of 548 1320 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 38 PID 548 wrote to memory of 964 548 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 39 PID 548 wrote to memory of 964 548 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 39 PID 548 wrote to memory of 964 548 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 39 PID 964 wrote to memory of 1592 964 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 40 PID 964 wrote to memory of 1592 964 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 40 PID 964 wrote to memory of 1592 964 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 40 PID 1592 wrote to memory of 1916 1592 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 41 PID 1592 wrote to memory of 1916 1592 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 41 PID 1592 wrote to memory of 1916 1592 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 41 PID 1916 wrote to memory of 1304 1916 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 42 PID 1916 wrote to memory of 1304 1916 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 42 PID 1916 wrote to memory of 1304 1916 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 42 PID 1304 wrote to memory of 1836 1304 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 43 PID 1304 wrote to memory of 1836 1304 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 43 PID 1304 wrote to memory of 1836 1304 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 43 PID 1836 wrote to memory of 1820 1836 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 44 PID 1836 wrote to memory of 1820 1836 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 44 PID 1836 wrote to memory of 1820 1836 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 44 PID 1820 wrote to memory of 1520 1820 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 45 PID 1820 wrote to memory of 1520 1820 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 45 PID 1820 wrote to memory of 1520 1820 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 45 PID 1520 wrote to memory of 828 1520 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 46 PID 1520 wrote to memory of 828 1520 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 46 PID 1520 wrote to memory of 828 1520 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 46 PID 828 wrote to memory of 1792 828 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 47 PID 828 wrote to memory of 1792 828 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 47 PID 828 wrote to memory of 1792 828 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 47 PID 1792 wrote to memory of 1668 1792 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 48 PID 1792 wrote to memory of 1668 1792 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 48 PID 1792 wrote to memory of 1668 1792 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 48 PID 1668 wrote to memory of 936 1668 6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe 49
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe"C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe23⤵
- Suspicious use of AdjustPrivilegeToken
PID:936 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe24⤵
- Suspicious use of AdjustPrivilegeToken
PID:696 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe25⤵
- Suspicious use of AdjustPrivilegeToken
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe26⤵
- Suspicious use of AdjustPrivilegeToken
PID:900 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe27⤵
- Suspicious use of AdjustPrivilegeToken
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe28⤵
- Suspicious use of AdjustPrivilegeToken
PID:560 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe29⤵
- Suspicious use of AdjustPrivilegeToken
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe30⤵
- Suspicious use of AdjustPrivilegeToken
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe31⤵
- Suspicious use of AdjustPrivilegeToken
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe32⤵
- Suspicious use of AdjustPrivilegeToken
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe33⤵
- Suspicious use of AdjustPrivilegeToken
PID:896 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe34⤵
- Suspicious use of AdjustPrivilegeToken
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe35⤵
- Suspicious use of AdjustPrivilegeToken
PID:508 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe36⤵
- Suspicious use of AdjustPrivilegeToken
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe37⤵
- Suspicious use of AdjustPrivilegeToken
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe38⤵
- Suspicious use of AdjustPrivilegeToken
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe39⤵
- Suspicious use of AdjustPrivilegeToken
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe40⤵
- Suspicious use of AdjustPrivilegeToken
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe41⤵
- Suspicious use of AdjustPrivilegeToken
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe42⤵
- Suspicious use of AdjustPrivilegeToken
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe43⤵
- Suspicious use of AdjustPrivilegeToken
PID:560 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe44⤵
- Suspicious use of AdjustPrivilegeToken
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe45⤵
- Suspicious use of AdjustPrivilegeToken
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe46⤵
- Suspicious use of AdjustPrivilegeToken
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe47⤵
- Suspicious use of AdjustPrivilegeToken
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe48⤵
- Suspicious use of AdjustPrivilegeToken
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe49⤵
- Suspicious use of AdjustPrivilegeToken
PID:872 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe50⤵
- Suspicious use of AdjustPrivilegeToken
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe51⤵
- Suspicious use of AdjustPrivilegeToken
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe52⤵
- Suspicious use of AdjustPrivilegeToken
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe53⤵
- Suspicious use of AdjustPrivilegeToken
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe54⤵
- Suspicious use of AdjustPrivilegeToken
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe55⤵
- Suspicious use of AdjustPrivilegeToken
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe56⤵
- Suspicious use of AdjustPrivilegeToken
PID:548 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe57⤵
- Suspicious use of AdjustPrivilegeToken
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe58⤵
- Suspicious use of AdjustPrivilegeToken
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe59⤵
- Suspicious use of AdjustPrivilegeToken
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe60⤵
- Suspicious use of AdjustPrivilegeToken
PID:432 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe61⤵
- Suspicious use of AdjustPrivilegeToken
PID:828 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe62⤵
- Suspicious use of AdjustPrivilegeToken
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe63⤵
- Suspicious use of AdjustPrivilegeToken
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe64⤵
- Suspicious use of AdjustPrivilegeToken
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe65⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe66⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe67⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe68⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe69⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe70⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe71⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe72⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe73⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe74⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe75⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe76⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe77⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe78⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe79⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe80⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe81⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe82⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe83⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe84⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe85⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe86⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe87⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe88⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe89⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe90⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe91⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe92⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe93⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe94⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe95⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe96⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe97⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe98⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe99⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe100⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe101⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe102⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe103⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe104⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe105⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe106⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe107⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe108⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe109⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe110⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe111⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe112⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe113⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe114⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe115⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe116⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe117⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe118⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe119⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe120⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe121⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exeC:\Users\Admin\AppData\Local\Temp\6f7b7c71a9d317ef22808e6fa1d2d3791b08802f7987763d33c538d6f7e7fd38.exe122⤵PID:1872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-