Overview
overview
10Static
static
10APIFOR.dll
windows7-x64
1APIFOR.dll
windows10-2004-x64
1BlitzedGrabberV14.exe
windows7-x64
10BlitzedGrabberV14.exe
windows10-2004-x64
10Costura.dll
windows7-x64
1Costura.dll
windows10-2004-x64
1DiscordRPC.dll
windows7-x64
1DiscordRPC.dll
windows10-2004-x64
1Guna.UI2.dll
windows7-x64
1Guna.UI2.dll
windows10-2004-x64
1Newtonsoft.Json.dll
windows7-x64
1Newtonsoft.Json.dll
windows10-2004-x64
1Sodium.dll
windows7-x64
1Sodium.dll
windows10-2004-x64
1System.Dia...ce.dll
windows7-x64
1System.Dia...ce.dll
windows10-2004-x64
1Vestris.Re...ib.dll
windows7-x64
1Vestris.Re...ib.dll
windows10-2004-x64
1dnlib.dll
windows7-x64
1dnlib.dll
windows10-2004-x64
1libsodium-64.dll
windows7-x64
1libsodium-64.dll
windows10-2004-x64
1libsodium.dll
windows7-x64
1libsodium.dll
windows10-2004-x64
1Analysis
-
max time kernel
25s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 14:01
Behavioral task
behavioral1
Sample
APIFOR.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
APIFOR.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
BlitzedGrabberV14.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
BlitzedGrabberV14.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
Costura.dll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
Costura.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
DiscordRPC.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
DiscordRPC.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Guna.UI2.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
Guna.UI2.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
Newtonsoft.Json.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
Newtonsoft.Json.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
Sodium.dll
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
Sodium.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral15
Sample
System.Diagnostics.DiagnosticSource.dll
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
System.Diagnostics.DiagnosticSource.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral17
Sample
Vestris.ResourceLib.dll
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
Vestris.ResourceLib.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
dnlib.dll
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
dnlib.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
libsodium-64.dll
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
libsodium-64.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
libsodium.dll
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
libsodium.dll
Resource
win10v2004-20230221-en
General
-
Target
BlitzedGrabberV14.exe
-
Size
4.1MB
-
MD5
62d761cb656ca111e5ce8ff8fb0d9176
-
SHA1
9c2b3438b84f4548f17f9ce231e54d02c1c887c6
-
SHA256
f070d635935054fb870319048b05750ba50135fe524fbad96b95f209e46928a2
-
SHA512
81ffaebd9a912a93e119542fc54297cc48d972a4a894ed458d00a942ac325ee861a43ec4bf9babb3ecfde1a98500413d03f6f821b1a5263ebe7eea8e9be9a5f0
-
SSDEEP
98304:2VniOdxVbQXti+ahvsWAno3COfOoEa6fY2hU2LOql6J5/uo:2VniCVbQdibsfoyOGoQw2e06tN
Malware Config
Extracted
xworm
104.129.24.110:55226
-
install_file
USB.exe
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
BLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBlitzedGrabberV14.exeSVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BlitzedGrabberV14.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation SVCHOST.EXE -
Drops startup file 2 IoCs
Processes:
SVCHOST.EXEdescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SVCHOST.lnk SVCHOST.EXE File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SVCHOST.lnk SVCHOST.EXE -
Executes dropped EXE 64 IoCs
Processes:
SVCHOST.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEpid process 3180 SVCHOST.EXE 4528 SVCHOST.EXE 368 SVCHOST.EXE 1516 BLITZEDGRABBERV14.EXE 1980 SVCHOST.EXE 876 SVCHOST.EXE 4520 BLITZEDGRABBERV14.EXE 3116 BLITZEDGRABBERV14.EXE 4948 SVCHOST.EXE 4556 SVCHOST.EXE 1460 SVCHOST.EXE 4304 SVCHOST.EXE 2664 SVCHOST.EXE 4940 SVCHOST.EXE 3752 SVCHOST.EXE 3648 SVCHOST.EXE 3356 SVCHOST.EXE 3388 SVCHOST.EXE 232 SVCHOST.EXE 800 SVCHOST.EXE 3472 SVCHOST.EXE 4728 BLITZEDGRABBERV14.EXE 2852 SVCHOST.EXE 4700 SVCHOST.EXE 368 SVCHOST.EXE 1568 SVCHOST.EXE 3776 SVCHOST.EXE 2232 SVCHOST.EXE 4328 BLITZEDGRABBERV14.EXE 4680 SVCHOST.EXE 2760 BLITZEDGRABBERV14.EXE 540 SVCHOST.EXE 4988 SVCHOST.EXE 4556 SVCHOST.EXE 224 SVCHOST.EXE 2648 SVCHOST.EXE 1980 SVCHOST.EXE 648 SVCHOST.EXE 3272 BLITZEDGRABBERV14.EXE 4996 SVCHOST.EXE 2652 SVCHOST.EXE 5036 SVCHOST.EXE 3436 BLITZEDGRABBERV14.EXE 3980 BLITZEDGRABBERV14.EXE 3220 SVCHOST.EXE 2152 BLITZEDGRABBERV14.EXE 3384 BLITZEDGRABBERV14.EXE 4512 BLITZEDGRABBERV14.EXE 3184 BLITZEDGRABBERV14.EXE 1988 BLITZEDGRABBERV14.EXE 1692 SVCHOST.EXE 4460 SVCHOST.EXE 1064 SVCHOST.EXE 4852 BLITZEDGRABBERV14.EXE 3188 SVCHOST.EXE 1880 SVCHOST.EXE 4668 BLITZEDGRABBERV14.EXE 3584 SVCHOST.EXE 4284 BLITZEDGRABBERV14.EXE 4940 SVCHOST.EXE 4872 BLITZEDGRABBERV14.EXE 2864 SVCHOST.EXE 4704 SVCHOST.EXE 2904 SVCHOST.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
SVCHOST.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SVCHOST = "C:\\ProgramData\\SVCHOST.EXE" SVCHOST.EXE -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 18 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
SVCHOST.EXEpid process 3180 SVCHOST.EXE -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
powershell.exeBLITZEDGRABBERV14.EXEpowershell.exeSVCHOST.EXEpid process 4188 powershell.exe 4188 powershell.exe 4188 powershell.exe 2900 BLITZEDGRABBERV14.EXE 2900 BLITZEDGRABBERV14.EXE 2900 BLITZEDGRABBERV14.EXE 3284 powershell.exe 3284 powershell.exe 3284 powershell.exe 3180 SVCHOST.EXE 3180 SVCHOST.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
SVCHOST.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEpowershell.exeSVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXEpowershell.exeSVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEdescription pid process Token: SeDebugPrivilege 3180 SVCHOST.EXE Token: SeDebugPrivilege 4528 SVCHOST.EXE Token: SeDebugPrivilege 368 SVCHOST.EXE Token: SeDebugPrivilege 1516 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 1980 SVCHOST.EXE Token: SeDebugPrivilege 876 SVCHOST.EXE Token: SeDebugPrivilege 4520 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 3116 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 4948 SVCHOST.EXE Token: SeDebugPrivilege 4556 SVCHOST.EXE Token: SeDebugPrivilege 1460 SVCHOST.EXE Token: SeDebugPrivilege 4304 SVCHOST.EXE Token: SeDebugPrivilege 2664 SVCHOST.EXE Token: SeDebugPrivilege 4940 SVCHOST.EXE Token: SeDebugPrivilege 3752 SVCHOST.EXE Token: SeDebugPrivilege 3648 SVCHOST.EXE Token: SeDebugPrivilege 3356 SVCHOST.EXE Token: SeDebugPrivilege 3388 SVCHOST.EXE Token: SeDebugPrivilege 232 SVCHOST.EXE Token: SeDebugPrivilege 800 SVCHOST.EXE Token: SeDebugPrivilege 4188 powershell.exe Token: SeDebugPrivilege 3472 SVCHOST.EXE Token: SeDebugPrivilege 4728 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 2852 SVCHOST.EXE Token: SeDebugPrivilege 2900 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 4700 SVCHOST.EXE Token: SeDebugPrivilege 368 SVCHOST.EXE Token: SeDebugPrivilege 1568 SVCHOST.EXE Token: SeDebugPrivilege 3284 powershell.exe Token: SeDebugPrivilege 3776 SVCHOST.EXE Token: SeDebugPrivilege 2232 SVCHOST.EXE Token: SeDebugPrivilege 4328 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 4680 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 2760 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 540 SVCHOST.EXE Token: SeDebugPrivilege 4988 SVCHOST.EXE Token: SeDebugPrivilege 4556 SVCHOST.EXE Token: SeDebugPrivilege 224 SVCHOST.EXE Token: SeDebugPrivilege 2648 SVCHOST.EXE Token: SeDebugPrivilege 1980 SVCHOST.EXE Token: SeDebugPrivilege 648 SVCHOST.EXE Token: SeDebugPrivilege 3272 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 4996 SVCHOST.EXE Token: SeDebugPrivilege 2652 SVCHOST.EXE Token: SeDebugPrivilege 5036 SVCHOST.EXE Token: SeDebugPrivilege 3436 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 3980 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 3220 SVCHOST.EXE Token: SeDebugPrivilege 2152 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 3384 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 3180 SVCHOST.EXE Token: SeDebugPrivilege 4512 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 3184 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 1988 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 1692 SVCHOST.EXE Token: SeDebugPrivilege 4460 SVCHOST.EXE Token: SeDebugPrivilege 1064 SVCHOST.EXE Token: SeDebugPrivilege 4852 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 3188 SVCHOST.EXE Token: SeDebugPrivilege 1880 SVCHOST.EXE Token: SeDebugPrivilege 4668 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 3584 SVCHOST.EXE Token: SeDebugPrivilege 4284 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 4940 SVCHOST.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
SVCHOST.EXEpid process 3180 SVCHOST.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
BlitzedGrabberV14.exeBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEConhost.exeBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEdescription pid process target process PID 5024 wrote to memory of 3540 5024 BlitzedGrabberV14.exe BLITZEDGRABBERV14.EXE PID 5024 wrote to memory of 3540 5024 BlitzedGrabberV14.exe BLITZEDGRABBERV14.EXE PID 5024 wrote to memory of 3540 5024 BlitzedGrabberV14.exe BLITZEDGRABBERV14.EXE PID 5024 wrote to memory of 3180 5024 BlitzedGrabberV14.exe SVCHOST.EXE PID 5024 wrote to memory of 3180 5024 BlitzedGrabberV14.exe SVCHOST.EXE PID 3540 wrote to memory of 2780 3540 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 3540 wrote to memory of 2780 3540 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 3540 wrote to memory of 2780 3540 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 3540 wrote to memory of 4528 3540 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 3540 wrote to memory of 4528 3540 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 2780 wrote to memory of 2060 2780 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 2780 wrote to memory of 2060 2780 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 2780 wrote to memory of 2060 2780 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 2780 wrote to memory of 368 2780 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 2780 wrote to memory of 368 2780 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 2060 wrote to memory of 3640 2060 BLITZEDGRABBERV14.EXE Conhost.exe PID 2060 wrote to memory of 3640 2060 BLITZEDGRABBERV14.EXE Conhost.exe PID 2060 wrote to memory of 3640 2060 BLITZEDGRABBERV14.EXE Conhost.exe PID 2060 wrote to memory of 1516 2060 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 2060 wrote to memory of 1516 2060 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 3640 wrote to memory of 4160 3640 Conhost.exe BLITZEDGRABBERV14.EXE PID 3640 wrote to memory of 4160 3640 Conhost.exe BLITZEDGRABBERV14.EXE PID 3640 wrote to memory of 4160 3640 Conhost.exe BLITZEDGRABBERV14.EXE PID 3640 wrote to memory of 1980 3640 Conhost.exe SVCHOST.EXE PID 3640 wrote to memory of 1980 3640 Conhost.exe SVCHOST.EXE PID 4160 wrote to memory of 4064 4160 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 4160 wrote to memory of 4064 4160 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 4160 wrote to memory of 4064 4160 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 4160 wrote to memory of 876 4160 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 4160 wrote to memory of 876 4160 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 4064 wrote to memory of 4268 4064 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 4064 wrote to memory of 4268 4064 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 4064 wrote to memory of 4268 4064 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 4064 wrote to memory of 4520 4064 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 4064 wrote to memory of 4520 4064 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 4268 wrote to memory of 1264 4268 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 4268 wrote to memory of 1264 4268 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 4268 wrote to memory of 1264 4268 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 4268 wrote to memory of 3116 4268 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 4268 wrote to memory of 3116 4268 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 1264 wrote to memory of 2212 1264 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 1264 wrote to memory of 2212 1264 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 1264 wrote to memory of 2212 1264 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 1264 wrote to memory of 4948 1264 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 1264 wrote to memory of 4948 1264 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 2212 wrote to memory of 2680 2212 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 2212 wrote to memory of 2680 2212 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 2212 wrote to memory of 2680 2212 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 2212 wrote to memory of 4556 2212 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 2212 wrote to memory of 4556 2212 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 2680 wrote to memory of 988 2680 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 2680 wrote to memory of 988 2680 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 2680 wrote to memory of 988 2680 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 2680 wrote to memory of 1460 2680 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 2680 wrote to memory of 1460 2680 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 988 wrote to memory of 2904 988 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 988 wrote to memory of 2904 988 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 988 wrote to memory of 2904 988 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 988 wrote to memory of 4304 988 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 988 wrote to memory of 4304 988 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 2904 wrote to memory of 2108 2904 SVCHOST.EXE Conhost.exe PID 2904 wrote to memory of 2108 2904 SVCHOST.EXE Conhost.exe PID 2904 wrote to memory of 2108 2904 SVCHOST.EXE Conhost.exe PID 2904 wrote to memory of 2664 2904 SVCHOST.EXE SVCHOST.EXE -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV14.exe"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV14.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"5⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"7⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"8⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"9⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"10⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"11⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"12⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"13⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"14⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"15⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"16⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"17⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"18⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"19⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"20⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"21⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"22⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"23⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"24⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"25⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"26⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"28⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"29⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"30⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"31⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"32⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"33⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"34⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"35⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"36⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"37⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"38⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"39⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"40⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"41⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"42⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"43⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"44⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"45⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"46⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"47⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"48⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"49⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"50⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"51⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"52⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"53⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"54⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"55⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"56⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"57⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"58⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"59⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"60⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"62⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"63⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"64⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"65⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"66⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"67⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"68⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"69⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"70⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"71⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"72⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"73⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"74⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"75⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"76⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"77⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"78⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"79⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"80⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"81⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"82⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"83⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"84⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"85⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"86⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"87⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"88⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"89⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"90⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"91⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"92⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"93⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"94⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"95⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"96⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"97⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"98⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"99⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"100⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"101⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"102⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"103⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"104⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"105⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"106⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"107⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"108⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"109⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"110⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"111⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"112⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"113⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"114⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"115⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"116⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"117⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"118⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"119⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"120⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"121⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"122⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"123⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"124⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"125⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"126⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"127⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"128⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"129⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"130⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"131⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"132⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"133⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"134⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"135⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"136⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"137⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"138⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"139⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"140⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"141⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"142⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"143⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"144⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"145⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"146⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"147⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"148⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"149⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"150⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"151⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"152⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"153⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"154⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"155⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"156⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"157⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"158⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"159⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"160⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"161⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"162⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"163⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"164⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"165⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"166⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"167⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"168⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"169⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"170⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"171⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"172⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"173⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"174⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"175⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"176⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"177⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"178⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"179⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"180⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"181⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"182⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"183⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"184⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"185⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"186⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"187⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"188⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"189⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"190⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"191⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"192⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"193⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"194⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"195⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"196⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"197⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"198⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"199⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"200⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"201⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"202⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"203⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"204⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"205⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"206⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"207⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"208⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"209⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"210⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"211⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"212⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"213⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"214⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"215⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"216⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"217⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"218⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"219⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"220⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"221⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"222⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"223⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"224⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"225⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"226⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"227⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"228⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"229⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"230⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"231⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"232⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"233⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"234⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"235⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"236⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"237⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"238⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"239⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"240⤵
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"241⤵