Overview
overview
10Static
static
10APIFOR.dll
windows7-x64
1APIFOR.dll
windows10-2004-x64
1BlitzedGrabberV14.exe
windows7-x64
10BlitzedGrabberV14.exe
windows10-2004-x64
10BlitzedGrabberV14.pdb
windows7-x64
3BlitzedGrabberV14.pdb
windows10-2004-x64
3Costura.dll
windows7-x64
1Costura.dll
windows10-2004-x64
1DiscordRPC.dll
windows7-x64
1DiscordRPC.dll
windows10-2004-x64
1Guna.UI2.dll
windows7-x64
1Guna.UI2.dll
windows10-2004-x64
1Newtonsoft.Json.dll
windows7-x64
1Newtonsoft.Json.dll
windows10-2004-x64
1Sodium.dll
windows7-x64
1Sodium.dll
windows10-2004-x64
1System.Dia...ce.dll
windows7-x64
1System.Dia...ce.dll
windows10-2004-x64
1Vestris.Re...ib.dll
windows7-x64
1Vestris.Re...ib.dll
windows10-2004-x64
1dnlib.dll
windows7-x64
1dnlib.dll
windows10-2004-x64
1libsodium-64.dll
windows7-x64
1libsodium-64.dll
windows10-2004-x64
1libsodium.dll
windows7-x64
1libsodium.dll
windows10-2004-x64
1Analysis
-
max time kernel
36s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14-04-2023 11:47
Behavioral task
behavioral1
Sample
APIFOR.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
APIFOR.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
BlitzedGrabberV14.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
BlitzedGrabberV14.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
BlitzedGrabberV14.pdb
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
BlitzedGrabberV14.pdb
Resource
win10v2004-20230221-en
Behavioral task
behavioral7
Sample
Costura.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
Costura.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
DiscordRPC.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
DiscordRPC.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
Guna.UI2.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
Guna.UI2.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
Newtonsoft.Json.dll
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
Newtonsoft.Json.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
Sodium.dll
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
Sodium.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
System.Diagnostics.DiagnosticSource.dll
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
System.Diagnostics.DiagnosticSource.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
Vestris.ResourceLib.dll
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
Vestris.ResourceLib.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
dnlib.dll
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
dnlib.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral23
Sample
libsodium-64.dll
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
libsodium-64.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
libsodium.dll
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
libsodium.dll
Resource
win10v2004-20230220-en
General
-
Target
BlitzedGrabberV14.exe
-
Size
4.1MB
-
MD5
62d761cb656ca111e5ce8ff8fb0d9176
-
SHA1
9c2b3438b84f4548f17f9ce231e54d02c1c887c6
-
SHA256
f070d635935054fb870319048b05750ba50135fe524fbad96b95f209e46928a2
-
SHA512
81ffaebd9a912a93e119542fc54297cc48d972a4a894ed458d00a942ac325ee861a43ec4bf9babb3ecfde1a98500413d03f6f821b1a5263ebe7eea8e9be9a5f0
-
SSDEEP
98304:2VniOdxVbQXti+ahvsWAno3COfOoEa6fY2hU2LOql6J5/uo:2VniCVbQdibsfoyOGoQw2e06tN
Malware Config
Extracted
xworm
104.129.24.110:55226
-
install_file
USB.exe
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
BLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBlitzedGrabberV14.exeBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXEdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BlitzedGrabberV14.exe Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation BLITZEDGRABBERV14.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation SVCHOST.EXE Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation SVCHOST.EXE -
Drops startup file 2 IoCs
Processes:
SVCHOST.EXEdescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SVCHOST.lnk SVCHOST.EXE File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SVCHOST.lnk SVCHOST.EXE -
Executes dropped EXE 64 IoCs
Processes:
SVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXEpid process 4920 SVCHOST.EXE 2280 SVCHOST.EXE 4840 SVCHOST.EXE 1528 SVCHOST.EXE 656 SVCHOST.EXE 4736 SVCHOST.EXE 3240 BLITZEDGRABBERV14.EXE 1840 SVCHOST.EXE 980 SVCHOST.EXE 2700 SVCHOST.EXE 3512 SVCHOST.EXE 4080 BLITZEDGRABBERV14.EXE 3992 SVCHOST.EXE 4480 SVCHOST.EXE 2332 SVCHOST.EXE 3016 SVCHOST.EXE 4772 BLITZEDGRABBERV14.EXE 2296 BLITZEDGRABBERV14.EXE 548 SVCHOST.EXE 1284 SVCHOST.EXE 4392 SVCHOST.EXE 2380 SVCHOST.EXE 4324 SVCHOST.EXE 4708 SVCHOST.EXE 4144 SVCHOST.EXE 2412 SVCHOST.EXE 3656 SVCHOST.EXE 4184 BLITZEDGRABBERV14.EXE 1136 SVCHOST.EXE 3924 SVCHOST.EXE 4028 BLITZEDGRABBERV14.EXE 4396 SVCHOST.EXE 1088 SVCHOST.EXE 4928 SVCHOST.EXE 640 SVCHOST.EXE 4340 BLITZEDGRABBERV14.EXE 1092 SVCHOST.EXE 1476 SVCHOST.EXE 3304 BLITZEDGRABBERV14.EXE 3004 BLITZEDGRABBERV14.EXE 5052 SVCHOST.EXE 4720 SVCHOST.EXE 4108 SVCHOST.EXE 3884 SVCHOST.EXE 2160 SVCHOST.EXE 3076 SVCHOST.EXE 3872 SVCHOST.EXE 888 SVCHOST.EXE 452 SVCHOST.EXE 4640 SVCHOST.EXE 2436 SVCHOST.EXE 3148 BLITZEDGRABBERV14.EXE 1128 SVCHOST.EXE 2256 SVCHOST.EXE 3484 SVCHOST.EXE 1768 BLITZEDGRABBERV14.EXE 1088 SVCHOST.EXE 396 SVCHOST.EXE 3668 BLITZEDGRABBERV14.EXE 1736 SVCHOST.EXE 1936 BLITZEDGRABBERV14.EXE 3860 SVCHOST.EXE 2252 SVCHOST.EXE 3016 SVCHOST.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
SVCHOST.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SVCHOST = "C:\\ProgramData\\SVCHOST.EXE" SVCHOST.EXE -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 13 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
SVCHOST.EXEpid process 4920 SVCHOST.EXE -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepowershell.exepowershell.exeSVCHOST.EXEpid process 4936 powershell.exe 4936 powershell.exe 3308 powershell.exe 3308 powershell.exe 3308 powershell.exe 2884 powershell.exe 2884 powershell.exe 4920 SVCHOST.EXE 4920 SVCHOST.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
SVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEpowershell.exeSVCHOST.EXESVCHOST.EXESVCHOST.EXEpowershell.exeSVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEpowershell.exeSVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEBLITZEDGRABBERV14.EXESVCHOST.EXEdescription pid process Token: SeDebugPrivilege 4920 SVCHOST.EXE Token: SeDebugPrivilege 2280 SVCHOST.EXE Token: SeDebugPrivilege 4840 SVCHOST.EXE Token: SeDebugPrivilege 1528 SVCHOST.EXE Token: SeDebugPrivilege 656 SVCHOST.EXE Token: SeDebugPrivilege 4736 SVCHOST.EXE Token: SeDebugPrivilege 3240 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 1840 SVCHOST.EXE Token: SeDebugPrivilege 980 SVCHOST.EXE Token: SeDebugPrivilege 2700 SVCHOST.EXE Token: SeDebugPrivilege 3512 SVCHOST.EXE Token: SeDebugPrivilege 4080 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 3992 SVCHOST.EXE Token: SeDebugPrivilege 4480 SVCHOST.EXE Token: SeDebugPrivilege 2332 SVCHOST.EXE Token: SeDebugPrivilege 3016 SVCHOST.EXE Token: SeDebugPrivilege 4772 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 2296 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 4936 powershell.exe Token: SeDebugPrivilege 548 SVCHOST.EXE Token: SeDebugPrivilege 1284 SVCHOST.EXE Token: SeDebugPrivilege 4392 SVCHOST.EXE Token: SeDebugPrivilege 3308 powershell.exe Token: SeDebugPrivilege 2380 SVCHOST.EXE Token: SeDebugPrivilege 4324 SVCHOST.EXE Token: SeDebugPrivilege 4708 SVCHOST.EXE Token: SeDebugPrivilege 4144 SVCHOST.EXE Token: SeDebugPrivilege 2884 powershell.exe Token: SeDebugPrivilege 2412 SVCHOST.EXE Token: SeDebugPrivilege 3656 SVCHOST.EXE Token: SeDebugPrivilege 4184 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 1136 SVCHOST.EXE Token: SeDebugPrivilege 3924 SVCHOST.EXE Token: SeDebugPrivilege 4028 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 4396 SVCHOST.EXE Token: SeDebugPrivilege 1088 SVCHOST.EXE Token: SeDebugPrivilege 4928 SVCHOST.EXE Token: SeDebugPrivilege 640 SVCHOST.EXE Token: SeDebugPrivilege 4340 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 1092 SVCHOST.EXE Token: SeDebugPrivilege 1476 SVCHOST.EXE Token: SeDebugPrivilege 3304 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 3004 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 5052 SVCHOST.EXE Token: SeDebugPrivilege 4720 SVCHOST.EXE Token: SeDebugPrivilege 4920 SVCHOST.EXE Token: SeDebugPrivilege 4108 SVCHOST.EXE Token: SeDebugPrivilege 3884 SVCHOST.EXE Token: SeDebugPrivilege 2160 SVCHOST.EXE Token: SeDebugPrivilege 3076 SVCHOST.EXE Token: SeDebugPrivilege 3872 SVCHOST.EXE Token: SeDebugPrivilege 888 SVCHOST.EXE Token: SeDebugPrivilege 452 SVCHOST.EXE Token: SeDebugPrivilege 4640 SVCHOST.EXE Token: SeDebugPrivilege 2436 SVCHOST.EXE Token: SeDebugPrivilege 3148 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 1128 SVCHOST.EXE Token: SeDebugPrivilege 2256 SVCHOST.EXE Token: SeDebugPrivilege 3484 SVCHOST.EXE Token: SeDebugPrivilege 1768 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 1088 SVCHOST.EXE Token: SeDebugPrivilege 396 SVCHOST.EXE Token: SeDebugPrivilege 3668 BLITZEDGRABBERV14.EXE Token: SeDebugPrivilege 1736 SVCHOST.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
SVCHOST.EXEpid process 4920 SVCHOST.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
BlitzedGrabberV14.exeBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEBLITZEDGRABBERV14.EXEdescription pid process target process PID 4504 wrote to memory of 2080 4504 BlitzedGrabberV14.exe BLITZEDGRABBERV14.EXE PID 4504 wrote to memory of 2080 4504 BlitzedGrabberV14.exe BLITZEDGRABBERV14.EXE PID 4504 wrote to memory of 2080 4504 BlitzedGrabberV14.exe BLITZEDGRABBERV14.EXE PID 4504 wrote to memory of 4920 4504 BlitzedGrabberV14.exe SVCHOST.EXE PID 4504 wrote to memory of 4920 4504 BlitzedGrabberV14.exe SVCHOST.EXE PID 2080 wrote to memory of 804 2080 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 2080 wrote to memory of 804 2080 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 2080 wrote to memory of 804 2080 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 2080 wrote to memory of 2280 2080 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 2080 wrote to memory of 2280 2080 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 804 wrote to memory of 2016 804 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 804 wrote to memory of 2016 804 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 804 wrote to memory of 2016 804 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 804 wrote to memory of 4840 804 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 804 wrote to memory of 4840 804 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 2016 wrote to memory of 4724 2016 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 2016 wrote to memory of 4724 2016 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 2016 wrote to memory of 4724 2016 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 2016 wrote to memory of 1528 2016 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 2016 wrote to memory of 1528 2016 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 4724 wrote to memory of 4940 4724 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 4724 wrote to memory of 4940 4724 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 4724 wrote to memory of 4940 4724 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 4724 wrote to memory of 656 4724 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 4724 wrote to memory of 656 4724 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 4940 wrote to memory of 100 4940 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 4940 wrote to memory of 100 4940 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 4940 wrote to memory of 100 4940 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 4940 wrote to memory of 4736 4940 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 4940 wrote to memory of 4736 4940 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 100 wrote to memory of 4764 100 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 100 wrote to memory of 4764 100 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 100 wrote to memory of 4764 100 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 100 wrote to memory of 3240 100 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 100 wrote to memory of 3240 100 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 4764 wrote to memory of 3032 4764 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 4764 wrote to memory of 3032 4764 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 4764 wrote to memory of 3032 4764 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 4764 wrote to memory of 1840 4764 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 4764 wrote to memory of 1840 4764 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 3032 wrote to memory of 3252 3032 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 3032 wrote to memory of 3252 3032 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 3032 wrote to memory of 3252 3032 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 3032 wrote to memory of 980 3032 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 3032 wrote to memory of 980 3032 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 3252 wrote to memory of 1532 3252 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 3252 wrote to memory of 1532 3252 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 3252 wrote to memory of 1532 3252 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 3252 wrote to memory of 2700 3252 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 3252 wrote to memory of 2700 3252 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 1532 wrote to memory of 3624 1532 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 1532 wrote to memory of 3624 1532 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 1532 wrote to memory of 3624 1532 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 1532 wrote to memory of 3512 1532 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 1532 wrote to memory of 3512 1532 BLITZEDGRABBERV14.EXE SVCHOST.EXE PID 3624 wrote to memory of 1828 3624 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 3624 wrote to memory of 1828 3624 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 3624 wrote to memory of 1828 3624 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 3624 wrote to memory of 4080 3624 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 3624 wrote to memory of 4080 3624 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 1828 wrote to memory of 4176 1828 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 1828 wrote to memory of 4176 1828 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 1828 wrote to memory of 4176 1828 BLITZEDGRABBERV14.EXE BLITZEDGRABBERV14.EXE PID 1828 wrote to memory of 3992 1828 BLITZEDGRABBERV14.EXE SVCHOST.EXE -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV14.exe"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV14.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"2⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"6⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"7⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:100 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"8⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"9⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"10⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"11⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"12⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"13⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"14⤵
- Checks computer location settings
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"15⤵
- Checks computer location settings
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"16⤵
- Checks computer location settings
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"17⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"18⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"19⤵
- Checks computer location settings
PID:772 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"20⤵
- Checks computer location settings
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"21⤵
- Checks computer location settings
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"22⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"23⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"24⤵
- Checks computer location settings
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"25⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"26⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"27⤵
- Checks computer location settings
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"28⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"29⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"30⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"31⤵
- Checks computer location settings
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"32⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"33⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"34⤵
- Checks computer location settings
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"35⤵
- Checks computer location settings
PID:444 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"36⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"37⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"38⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"39⤵
- Checks computer location settings
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"40⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"41⤵
- Checks computer location settings
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"42⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"44⤵
- Checks computer location settings
PID:684 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"45⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"46⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"47⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"48⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"49⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"50⤵
- Checks computer location settings
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"51⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"52⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"53⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"54⤵
- Checks computer location settings
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"55⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"56⤵
- Checks computer location settings
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"57⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"58⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"59⤵
- Checks computer location settings
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"60⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"61⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"62⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"63⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"64⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"65⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"66⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"67⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"68⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"69⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"70⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"71⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"72⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"73⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"74⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"75⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"76⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"77⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"78⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"79⤵
- Checks computer location settings
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"80⤵
- Checks computer location settings
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"81⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"82⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"83⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"84⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"85⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"86⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"87⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"88⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"89⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"90⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"91⤵
- Checks computer location settings
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"92⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"93⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"94⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"95⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"96⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"97⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"98⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"99⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"100⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"101⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"102⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"103⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"104⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"105⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"106⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"107⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"108⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"109⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"110⤵
- Checks computer location settings
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"111⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"112⤵
- Checks computer location settings
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"113⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"114⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"115⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"116⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"117⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"118⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"119⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"120⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"121⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"122⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"123⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"124⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"125⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"126⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"127⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"128⤵
- Checks computer location settings
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"129⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"130⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"131⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"132⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"133⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"134⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"135⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"136⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"137⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"138⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"139⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"140⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"141⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"142⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"143⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"144⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"145⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"146⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"147⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"148⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"149⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"150⤵
- Checks computer location settings
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"151⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"152⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"153⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"154⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"155⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"156⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"157⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"158⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"159⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"160⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"161⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"162⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"163⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"164⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"165⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"166⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"167⤵
- Checks computer location settings
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"168⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"169⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"170⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"171⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"172⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"173⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"174⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"175⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"176⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"177⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"178⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"179⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"180⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"181⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"182⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"183⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"184⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"185⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"186⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"187⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"188⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"189⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"190⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"191⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"192⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"193⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"194⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"195⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"196⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"197⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"198⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE"C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE"199⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"199⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"200⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"201⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"202⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"203⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"204⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"205⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"206⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"207⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"208⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"209⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"210⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"211⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"212⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"213⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"214⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"215⤵
- Checks computer location settings
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"216⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"217⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"218⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"219⤵
- Checks computer location settings
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"220⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"221⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"222⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"223⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"224⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"225⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"226⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"227⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"228⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"229⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"230⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"231⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"232⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"233⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"234⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"235⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"236⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"237⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE"C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE"238⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:888 -
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"238⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"239⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"240⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"C:\Users\Admin\AppData\Local\Temp\BLITZEDGRABBERV14.EXE"241⤵PID:4076
-