Overview
overview
10Static
static
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
7Resubmissions
28-07-2024 16:38
240728-t5tryssgmm 1007-07-2024 14:07
240707-rfgd8atekm 1007-07-2024 14:07
240707-re689awdpe 1013-09-2022 17:54
220913-wg1lpsgbg7 10Analysis
-
max time kernel
1563s -
max time network
1690s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
07-07-2024 14:07
Static task
static1
Behavioral task
behavioral1
Sample
RansomwareSamples/Avaddon_09_06_2020_1054KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
RansomwareSamples/Avaddon_09_06_2020_1054KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
RansomwareSamples/Avos_18_07_2021_403KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
RansomwareSamples/Avos_18_07_2021_403KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
RansomwareSamples/Babik_04_01_2021_31KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
RansomwareSamples/Babik_04_01_2021_31KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
RansomwareSamples/Babuk_20_04_2021_79KB.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
RansomwareSamples/Babuk_20_04_2021_79KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
RansomwareSamples/BlackKingdom_23_03_2021_12460KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
RansomwareSamples/BlackKingdom_23_03_2021_12460KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral11
Sample
RansomwareSamples/BlackMatter_02_08_2021_67KB.exe
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
RansomwareSamples/BlackMatter_02_08_2021_67KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
RansomwareSamples/Conti_22_12_2020_186KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
RansomwareSamples/Conti_22_12_2020_186KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral15
Sample
RansomwareSamples/Cuba_08_03_2021_1130KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
RansomwareSamples/Cuba_08_03_2021_1130KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral17
Sample
RansomwareSamples/DarkSide_01_05_2021_30KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
RansomwareSamples/DarkSide_01_05_2021_30KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral19
Sample
RansomwareSamples/DarkSide_16_01_2021_59KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
RansomwareSamples/DarkSide_16_01_2021_59KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral21
Sample
RansomwareSamples/DarkSide_18_11_2020_17KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
RansomwareSamples/DarkSide_18_11_2020_17KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral23
Sample
RansomwareSamples/DearCry_13_03_2021_1292KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
RansomwareSamples/DearCry_13_03_2021_1292KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral25
Sample
RansomwareSamples/Hades_29_03_2021_1909KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
RansomwareSamples/Hades_29_03_2021_1909KB.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
RansomwareSamples/Hive_17_07_2021_808KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
RansomwareSamples/Hive_17_07_2021_808KB.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
RansomwareSamples/LockBit_14_02_2021_146KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
RansomwareSamples/LockBit_14_02_2021_146KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral31
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win10v2004-20240704-en
General
-
Target
RansomwareSamples/Hive_17_07_2021_808KB.exe
-
Size
808KB
-
MD5
504bd1695de326bc533fde29b8a69319
-
SHA1
67f0c8d81aefcfc5943b31d695972194ac15e9f2
-
SHA256
a0b4e3d7e4cd20d25ad2f92be954b95eea44f8f1944118a3194295c5677db749
-
SHA512
18c5b28bafb13edf47f6a2b803d9d9a914945f037b266a765f2a324842c5ef04ebda27eba31851d2d63e00779a42900e0edfe4ad5bd817eb4f43fa4d4e3a4767
-
SSDEEP
24576:lafTGwLNdRk4RBtr/ioF4/I+CMx3cMt3/4KFG8Qz4YwY:IT7dRFr/ioFjicMtvV4z
Malware Config
Extracted
C:\$Recycle.Bin\HOW_TO_DECRYPT.txt
hive
http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/
http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
Signatures
-
Detects Go variant of Hive Ransomware 53 IoCs
Processes:
resource yara_rule behavioral27/memory/3020-73-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-85-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-558-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-1721-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-2906-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-3560-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-4326-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-4335-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-4336-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-4337-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-4338-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-5668-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-8139-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-10988-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11884-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11885-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11887-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11890-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11891-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11894-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11895-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11897-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11899-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11901-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11903-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11905-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11907-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11909-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11912-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11914-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11916-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11918-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11920-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11923-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11925-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11927-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11929-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11931-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11933-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11935-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11937-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11939-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11942-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11944-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11946-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11948-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11951-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11953-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11975-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11978-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11980-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-11982-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go behavioral27/memory/3020-12008-0x0000000000B10000-0x0000000000DE9000-memory.dmp hive_go -
Hive
A ransomware written in Golang first seen in June 2021.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops file in Drivers directory 29 IoCs
Processes:
Hive_17_07_2021_808KB.exedescription ioc process File created C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\drivers\UMDF\it-IT\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\drivers\UMDF\de-DE\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\drivers\UMDF\es-ES\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\drivers\UMDF\fr-FR\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\drivers\es-ES\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\drivers\ja-JP\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\es-ES\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\etc\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\drivers\UMDF\ja-JP\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\UMDF\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\drivers\it-IT\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\UMDF\de-DE\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\UMDF\ja-JP\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\de-DE\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\fr-FR\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\UMDF\fr-FR\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\drivers\de-DE\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\UMDF\es-ES\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\it-IT\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\ja-JP\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\drivers\fr-FR\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\UMDF\it-IT\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\en-US\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe -
Boot or Logon Autostart Execution: Print Processors 1 TTPs 7 IoCs
Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
Processes:
Hive_17_07_2021_808KB.exedescription ioc process File created C:\Windows\System32\spool\prtprocs\x64\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\spool\prtprocs\x64\de-DE\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\spool\prtprocs\x64\en-US\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\spool\prtprocs\x64\es-ES\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\spool\prtprocs\x64\fr-FR\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\spool\prtprocs\x64\it-IT\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\spool\prtprocs\x64\ja-JP\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2568 cmd.exe -
Drops startup file 4 IoCs
Processes:
Hive_17_07_2021_808KB.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.-uYcD1toMB6z-bE3g_VWOQ7EUj-WNiccrn6Rqkkqn3Q.hive Hive_17_07_2021_808KB.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral27/memory/3020-0-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-73-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-85-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-558-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-1721-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-2906-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-3560-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-4326-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-4335-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-4336-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-4337-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-4338-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-5668-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-8139-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-10988-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11884-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11885-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11887-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11890-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11891-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11894-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11895-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11897-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11899-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11901-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11903-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11905-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11907-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11909-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11912-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11914-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11916-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11918-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11920-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11923-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11925-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11927-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11929-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11931-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11933-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11935-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11937-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11939-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11942-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11944-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11946-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11948-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11951-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11953-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11975-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11978-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11980-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-11982-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx behavioral27/memory/3020-12008-0x0000000000B10000-0x0000000000DE9000-memory.dmp upx -
Drops desktop.ini file(s) 64 IoCs
Processes:
Hive_17_07_2021_808KB.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\E9P9LRO9\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OJBRRE9R\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\FGBCC7A8\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Hive_17_07_2021_808KB.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\Music\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Public\Downloads\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\Videos\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JVMDVGRW\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Public\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\Links\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\Documents\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\G4UA8T7D\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FH198YO1\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Public\Libraries\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Public\Pictures\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI Hive_17_07_2021_808KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XLI5Q0EH\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini Hive_17_07_2021_808KB.exe -
Drops file in System32 directory 64 IoCs
Processes:
Hive_17_07_2021_808KB.exedescription ioc process File created C:\Windows\System32\DriverStore\FileRepository\prnin003.inf_amd64_neutral_3a3c6293d0cda862\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\GroupPolicy\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\prnca00y.inf_amd64_neutral_64560c72e81f6ad7\Amd64\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\es-ES\Licenses\eval\StarterE\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\it-IT\Licenses\_Default\StarterN\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\es-ES\Licenses\eval\HomeBasic\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\wpdfs.inf_amd64_neutral_fc4ebadff3a40ae4\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\es-ES\Licenses\eval\EnterpriseN\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\ja-JP\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\eaphost.inf_amd64_neutral_4506dea11740c089\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\fr\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\es-ES\Licenses\OEM\Enterprise\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\ja-JP\Licenses\eval\EnterpriseE\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\ja-JP\Licenses\_Default\Ultimate\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\migration\it-IT\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\spp\tokens\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\dot4prt.inf_amd64_neutral_e7d3f62d0d4411db\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\LogFiles\SQM\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\Tasks\WPD\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\it-IT\Licenses\eval\EnterpriseN\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky305.inf_amd64_ja-jp_4d77cc4802b17ec3\Amd64\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\de-DE\Licenses\eval\EnterpriseN\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\XPSViewer\fr-FR\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\UltimateN\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\sysprep\en-US\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\XPSViewer\es-ES\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_neutral_4b99fffee061ff26\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\de-DE\Licenses\_Default\Starter\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\smartcrd.inf_amd64_neutral_6fb75ea318f84fe5\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\Setup\de-DE\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8TXB0XXK\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\migwiz\dlmanifests\Networking-MPSSVC-Svc\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\com\en-US\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\en-US\Licenses\OEM\ProfessionalN\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\en-US\Licenses\_Default\HomePremiumN\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\migration\ja-JP\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\it-IT\Licenses\_Default\HomeBasic\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\en-US\Licenses\_Default\UltimateN\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\WCN\de-DE\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmolic.inf_amd64_neutral_a53ac1a125d227fc\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\IME\imekr8\applets\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\Msdtc\Trace\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\en-US\Licenses\eval\ProfessionalN\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\fr-FR\Licenses\eval\HomePremium\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\migwiz\PostMigRes\Web\base_images\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky302.inf_amd64_ja-jp_dd74fe49601b74f6\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AW10BNB7\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\it-IT\Licenses\OEM\HomeBasicN\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\de-DE\Licenses\eval\StarterE\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\en-US\Licenses\_Default\EnterpriseN\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\SMI\Manifests\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\it-IT\Licenses\eval\HomeBasicE\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\en-US\Licenses\_Default\Ultimate\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmc26a.inf_amd64_neutral_547edd894d7c19d9\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\prnkm004.inf_amd64_neutral_d2aee42dc9c393ea\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\Tasks\Microsoft\Windows\Windows Error Reporting\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-IasServer-MigPlugin\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmrock4.inf_amd64_neutral_e45293c539584293\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\SMI\Store\Machine\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\wbem\xml\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx00y.inf_amd64_neutral_977318f2317f5ddd\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\config\TxR\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Hive_17_07_2021_808KB.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kamchatka.-uYcD1toMB6z-bE3g_VWOSQIsO8IMhgF7aX1QOzV71k.hive Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\gradient.png Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\liberase_plugin.dll.-uYcD1toMB6z-bE3g_VWOXYURyTcJN8z4dP3lvbZulE.hive Hive_17_07_2021_808KB.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Program Files (x86)\Windows Photo Viewer\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_ja_4.4.0.v20140623020002.jar Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01291_.WMF Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200521.WMF Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EADOCUMENTAPPROVAL_REVIEW.XSN Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\settings.css Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6 Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLVBS.DLL Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\psuser_64.dll.-uYcD1toMB6z-bE3g_VWOZdsFKYB17Nw4Hd7fllFEAk.hive Hive_17_07_2021_808KB.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert.css Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB1B.BDR Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-outline.jar Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Eirunepe Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\msdasql.dll Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_zh_CN.jar.-uYcD1toMB6z-bE3g_VWOWYmM4bVA6goIhfl0etOVCg.hive Hive_17_07_2021_808KB.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.metadataprovider.exsd Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Resources.dll Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\RSSFeeds.html Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\FS3BOX.POC Hive_17_07_2021_808KB.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jerusalem Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianLetter.Dotx Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18196_.WMF Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay.css Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\NEWS.XML Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yellowknife Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-awt.xml Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Easter Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\highDpiImageSwap.js Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04385_.WMF Hive_17_07_2021_808KB.exe File created C:\Program Files\VideoLAN\VLC\locale\sw\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml Hive_17_07_2021_808KB.exe File created C:\Program Files\Java\jre7\bin\plugin2\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\DVD Maker\es-ES\DVDMaker.exe.mui Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152892.WMF Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Ndjamena.-uYcD1toMB6z-bE3g_VWOejkriX1C3kBXs7XK-NDOTE.hive Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\RSSFeeds.js Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libnormvol_plugin.dll Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\21.png Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGPUNCT.XML Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8 Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\instrument.dll.-uYcD1toMB6z-bE3g_VWOTM_qx8rQvwbv9OeH7Mlaxw.hive Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcanvas_plugin.dll Hive_17_07_2021_808KB.exe File created C:\Program Files (x86)\Windows Media Player\Network Sharing\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\vlc.mo Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Faculty.accdt Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02074U.BMP Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-attach.xml Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\settings.css Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libscene_plugin.dll.-uYcD1toMB6z-bE3g_VWOZckA1cwiKxC3-vmLcM_dxA.hive Hive_17_07_2021_808KB.exe -
Drops file in Windows directory 64 IoCs
Processes:
Hive_17_07_2021_808KB.exedescription ioc process File created C:\Windows\Branding\Basebrd\ja-JP\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\assembly\GAC_MSIL\MiguiControls\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Dynamic\770a605d5193c730225204fa780278ae\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_server-help-chm.mmc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6fe1f4a7f8512ee9\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\x86_microsoft-windows-dskquota.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a35ddd3ab3e846e1\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-feedback-service_31bf3856ad364e35_6.1.7600.16385_none_d5c0e508aa96a650\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-netvsta.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8e2308b4c72ddb0e\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\x86_microsoft-windows-btpanui-mui.resources_31bf3856ad364e35_6.1.7600.16385_it-it_742ca32d0094a20a\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_prnhp005.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_89c102ed2ea8f023\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..utoenroll.resources_31bf3856ad364e35_6.1.7600.16385_it-it_47b8ac96851475dc\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\x86_microsoft-windows-scripting.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2d85ca15abc04414\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_netnvma.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5cd47ea41c470020\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\x86_microsoft-windows-servicereportingapi_31bf3856ad364e35_6.1.7600.16385_none_6c7678cbda7098f8\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..l-keyboard-0000042c_31bf3856ad364e35_6.1.7600.16385_none_59634f5e6fa7d5d1\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-feedsbs.resources_31bf3856ad364e35_8.0.7600.16385_ja-jp_edf96fb1262f5b5c\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_netfx35linq-system....dynamicdata.design_31bf3856ad364e35_6.1.7601.17514_none_f48e45c7055224f8\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\inf\.NET CLR Networking 4.0.0.0\000D\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\msil_microsoft.iis.power...provider.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_8f36c53b01dec296\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mfdvdec_31bf3856ad364e35_6.1.7600.16385_none_64a6ece3617cfb74\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-r..lperclass.resources_31bf3856ad364e35_6.1.7600.16385_it-it_56ef5165204df522\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\msil_msbuild.resources_b03f5f7f11d50a3a_3.5.7600.16385_ja-jp_586fdad8bd134e99\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\x86_netfx-sbs_sys_data_dll_31bf3856ad364e35_6.1.7600.16385_none_fe6017304e1a4816\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\assembly\GAC_MSIL\System.XML.resources\2.0.0.0_es_b77a5c561934e089\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ndisuio.resources_31bf3856ad364e35_6.1.7600.16385_es-es_f8133cc8594b3790\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_wcf-m_smsvchost_perf_c_ini_31bf3856ad364e35_6.1.7600.16385_none_902b82bc25e07ac6\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\msil_microsoft.grouppolicy.reporting_31bf3856ad364e35_6.1.7601.17514_none_4c14798809666596\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_6.1.7600.16385_none_a749cec7a8b6bf08\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-mail.resources_31bf3856ad364e35_6.1.7600.16385_de-de_00ed58017fd687e8\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-shunimpl_31bf3856ad364e35_6.1.7601.17514_none_b3bc7baa4af52181\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\x86_microsoft-windows-audio-mci_31bf3856ad364e35_6.1.7600.16385_none_1ce3af494d8b953d\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\x86_microsoft-windows-ldap-client.resources_31bf3856ad364e35_6.1.7600.16385_de-de_32516987997ca2b8\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ieframe.resources_31bf3856ad364e35_8.0.7600.16385_es-es_0640ddf35e8847b1\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-l..epremiumn.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_bc8aa7bd88265509\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-netplwiz.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2dd66c79c7e4f8e2\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\msil_system.data.oracleclient.resources_b77a5c561934e089_6.1.7600.16385_it-it_e8dad23a13148696\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..fications.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8b669fa14daef0eb\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-class_ss.resources_31bf3856ad364e35_6.1.7600.16385_en-us_9c43114bf49ad2c9\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..l-keyboard-0001040e_31bf3856ad364e35_6.1.7600.16385_none_fd64cf5361a6c8d6\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..ty-syskey.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_47ae60c666d2a843\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..tional-codepage-864_31bf3856ad364e35_6.1.7600.16385_none_cebf380cfc84b5bf\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..trics-cpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_296d0df052df9526\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-http-api.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_53ea200d3ef98f2e\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-powercfg.resources_31bf3856ad364e35_6.1.7600.16385_en-us_84ef507e8404018b\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..onal-codepage-28592_31bf3856ad364e35_6.1.7600.16385_none_b188802cfdb67997\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-previousversions-adm_31bf3856ad364e35_6.1.7600.16385_none_41d785d4f443b620\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-behaviors.resources_31bf3856ad364e35_8.0.7600.16385_de-de_9916db26952fe7f2\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..ltinstall.resources_31bf3856ad364e35_6.1.7600.16385_de-de_07c23c1fe40f7920\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_security-malware-wi..er-events.resources_31bf3856ad364e35_6.1.7600.16385_en-us_dab3100a21f7543b\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\x86_microsoft-windows-wininit.resources_31bf3856ad364e35_6.1.7600.16385_de-de_9c4b10f07cfccf53\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\x86_microsoft-windows-wlanui.resources_31bf3856ad364e35_6.1.7600.16385_es-es_269cc1254400eed5\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-c..r-name-ui.resources_31bf3856ad364e35_6.1.7600.16385_it-it_a2020e67811e5799\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-iisbasic.resources_31bf3856ad364e35_6.1.7600.16385_de-de_230604a78e189958\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mobsync.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d761dac9339ff88c\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_prnrc004.inf_31bf3856ad364e35_6.1.7600.16385_none_21e7809d8e910def\Amd64\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\wow64_microsoft-windows-scripting-jscript_31bf3856ad364e35_11.2.9600.16428_none_6f8ba5f740934aae\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..tbranding.resources_31bf3856ad364e35_8.0.7600.16385_ja-jp_3f9f9ef99cdb9cde\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-directx-direct3d11_31bf3856ad364e35_7.1.7601.16492_none_3ef665796f74e084\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-netprofui.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3cfdaed76b6ce5f9\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tasklist.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1c4d3cb94d962c50\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\x86_microsoft-windows-h..centercpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_fdec13235c1fa8e5\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\amd64_microsoft-windows-o..s-service.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_56fb8cc6dcb2acfb\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\winsxs\x86_microsoft-windows-a..apc-layer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c5ccee6ea35066e8\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe -
Delays execution with timeout.exe 64 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 2788 timeout.exe 2624 timeout.exe 2700 timeout.exe 1648 timeout.exe 184 timeout.exe 2532 timeout.exe 2900 timeout.exe 2592 timeout.exe 2560 timeout.exe 1304 timeout.exe 1960 timeout.exe 476 timeout.exe 276 timeout.exe 1208 timeout.exe 1980 timeout.exe 2204 timeout.exe 1596 timeout.exe 2904 timeout.exe 560 timeout.exe 1716 timeout.exe 2672 timeout.exe 1264 timeout.exe 1196 timeout.exe 2684 timeout.exe 1516 timeout.exe 1640 timeout.exe 1636 timeout.exe 888 timeout.exe 944 timeout.exe 1536 timeout.exe 1692 timeout.exe 2076 timeout.exe 1656 timeout.exe 2068 timeout.exe 1208 timeout.exe 2224 timeout.exe 1736 timeout.exe 1548 timeout.exe 2648 timeout.exe 3016 timeout.exe 1568 timeout.exe 852 timeout.exe 1160 timeout.exe 1288 timeout.exe 1608 timeout.exe 1664 timeout.exe 780 timeout.exe 632 timeout.exe 2172 timeout.exe 3016 timeout.exe 1616 timeout.exe 896 timeout.exe 2704 timeout.exe 1612 timeout.exe 932 timeout.exe 352 timeout.exe 324 timeout.exe 2932 timeout.exe 2652 timeout.exe 1420 timeout.exe 2944 timeout.exe 1528 timeout.exe 2380 timeout.exe 2392 timeout.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2868 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Hive_17_07_2021_808KB.exepid process 3020 Hive_17_07_2021_808KB.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2296 vssvc.exe Token: SeRestorePrivilege 2296 vssvc.exe Token: SeAuditPrivilege 2296 vssvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Hive_17_07_2021_808KB.execmd.execmd.exedescription pid process target process PID 3020 wrote to memory of 2568 3020 Hive_17_07_2021_808KB.exe cmd.exe PID 3020 wrote to memory of 2568 3020 Hive_17_07_2021_808KB.exe cmd.exe PID 3020 wrote to memory of 2568 3020 Hive_17_07_2021_808KB.exe cmd.exe PID 3020 wrote to memory of 2248 3020 Hive_17_07_2021_808KB.exe cmd.exe PID 3020 wrote to memory of 2248 3020 Hive_17_07_2021_808KB.exe cmd.exe PID 3020 wrote to memory of 2248 3020 Hive_17_07_2021_808KB.exe cmd.exe PID 2568 wrote to memory of 2864 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2864 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2864 2568 cmd.exe timeout.exe PID 2248 wrote to memory of 2868 2248 cmd.exe vssadmin.exe PID 2248 wrote to memory of 2868 2248 cmd.exe vssadmin.exe PID 2248 wrote to memory of 2868 2248 cmd.exe vssadmin.exe PID 2568 wrote to memory of 2128 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2128 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2128 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 1656 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 1656 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 1656 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 1996 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 1996 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 1996 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2332 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2332 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2332 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2008 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2008 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2008 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 112 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 112 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 112 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2240 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2240 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2240 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 324 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 324 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 324 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 1728 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 1728 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 1728 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 1788 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 1788 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 1788 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2828 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2828 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2828 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2620 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2620 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2620 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 1740 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 1740 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 1740 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2480 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2480 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2480 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2288 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2288 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2288 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2948 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2948 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2948 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2676 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2676 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 2676 2568 cmd.exe timeout.exe PID 2568 wrote to memory of 1208 2568 cmd.exe timeout.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Hive_17_07_2021_808KB.exe"C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Hive_17_07_2021_808KB.exe"1⤵
- Drops file in Drivers directory
- Boot or Logon Autostart Execution: Print Processors
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\system32\cmd.execmd /c hive.bat >NUL 2>NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\system32\timeout.exetimeout 13⤵PID:2864
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2128
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1656
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1996
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2332
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2008
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:112
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2240
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:324
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1728
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1788
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2828
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2620
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1740
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2480
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2288
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2948
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2676
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1208
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1516
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2740
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2380
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1644
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1936
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2364
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1292
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1860
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2432
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2932
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3064
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1996
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2588
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1976
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1592
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1732
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2280
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1736
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:552
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1848
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2356
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2624
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:920
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1916
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2988
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2128
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1440
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:216
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2108
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1640
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2204
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:656
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:212
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2732
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:764
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2068
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1304
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2084
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:212
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:908
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2616
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2364
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2652
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2828
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2588
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3052
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1508
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1980
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1576
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1360
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:224
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2988
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2668
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1724
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2380
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1704
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1856
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1356
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2356
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1960
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2304
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2028
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2612
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1420
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1480
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:352
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2916
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:236
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2924
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1580
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1680
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2908
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1016
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2648
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2696
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2272
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2180
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2704
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3040
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1264
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1644
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:112
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2064
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2236
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:852
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:944
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2572
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1500
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1088
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1704
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2456
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:952
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3032
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1688
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2916
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2380
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3052
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1832
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:156
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2696
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2260
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3064
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2700
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2196
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2964
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2108
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:928
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1732
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2492
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2928
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2456
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3016
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2624
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1952
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2076
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:204
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2944
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1352
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:560
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2480
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1588
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2244
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:476
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:612
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2004
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2172
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1160
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2088
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1672
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1532
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1612
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2464
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2060
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2392
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:308
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2120
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:276
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2580
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3068
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2532
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1636
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2788
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2288
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1848
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1528
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:888
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:936
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2516
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1592
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1288
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1788
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:932
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2252
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:208
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2892
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2632
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:892
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:852
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2616
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2644
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2876
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2320
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2236
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2560
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2380
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2404
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2116
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1664
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1412
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2588
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2912
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1360
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:944
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1204
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1980
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:224
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3052
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:764
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2872
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1208
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1416
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2280
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1960
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2612
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2264
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1892
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2224
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2540
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:352
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2196
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1648
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2792
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1580
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1712
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1624
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2924
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1680
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1764
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1876
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2608
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2188
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2272
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2012
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1264
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:372
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1640
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2180
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3040
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2128
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1736
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1436
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:708
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2716
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1064
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2292
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:316
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1132
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3000
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1140
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2212
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1872
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:448
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2460
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:768
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1608
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2228
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1720
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1548
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2368
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1956
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2008
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:712
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2204
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1536
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1564
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:680
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1596
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1500
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2840
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2000
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2072
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2032
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1256
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1776
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:884
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1880
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2492
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2656
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2208
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2700
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:960
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2216
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1740
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1696
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:232
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1440
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:200
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2984
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1692
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2456
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:3016
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2624
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1952
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2076
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:656
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2488
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1352
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:560
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2480
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:328
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1976
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:612
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2004
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2572
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1732
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1160
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2056
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:108
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2580
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1660
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1448
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2532
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1636
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2520
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2288
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1848
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2220
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1528
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2900
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:592
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3064
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2708
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1668
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:212
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1304
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:992
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2084
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2632
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2024
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2372
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2616
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2628
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2652
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1896
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2868
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2332
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2236
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2964
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2796
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1724
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2844
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1664
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1412
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2588
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2912
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1360
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2824
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1204
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2772
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2416
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2940
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2988
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2848
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2412
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1932
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2304
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:764
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2872
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1208
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2348
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2684
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:376
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2420
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1420
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1556
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1688
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:352
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:780
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1648
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:236
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2732
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1624
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2924
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2860
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2904
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1876
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2648
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2704
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2384
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2012
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1264
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:372
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1640
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2180
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3040
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2128
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3032
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1540
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2968
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1064
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3036
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2100
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:952
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1716
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1140
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2212
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1872
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:448
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1632
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2468
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2260
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:632
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1600
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1652
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1548
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2368
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1956
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1036
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1016
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2552
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1196
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:956
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:184
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1596
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2948
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2428
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2712
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1616
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2452
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2592
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1256
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1776
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:884
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1880
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2492
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:804
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:916
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:896
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1492
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1844
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1144
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1012
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1440
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1704
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2820
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:408
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:3016
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2624
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:204
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2076
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2660
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:656
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2488
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1352
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1588
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2480
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:328
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:476
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:612
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2172
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1568
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:808
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1160
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2056
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:276
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2740
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3068
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1368
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2788
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2068
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1524
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1456
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2220
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2284
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:936
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2516
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1592
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2708
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:932
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2252
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:208
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2892
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1576
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2672
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:852
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2620
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2828
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2628
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2360
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2876
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2320
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1852
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2556
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2560
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1656
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2156
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3060
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1508
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2416
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2988
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2848
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2412
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1932
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2304
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2028
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1432
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1416
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2280
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2684
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:376
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2420
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2692
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1556
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1688
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2432
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:780
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1604
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1580
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:156
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1356
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1764
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:820
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2636
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2608
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2696
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2704
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:112
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2012
-
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1264
-
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:372
-
-
-
C:\Windows\system32\cmd.execmd /c shadow.bat >NUL 2>NUL2⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2868
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2296
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:3064
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ee4ad142674725d6d9b58c9c3bb836dc
SHA1ac9bac37131c72a549d2bf3fbd233061906d5fab
SHA256fc1f1ed6a6692d18788de47420ead7e8a1b534b015db69a39052a0a2fc30c776
SHA512a34c547d13880b578703f52b7d3d61b1893536966204d80a9e0f60aee8851bd9f70e3d0ceb1601aa11901c6315f57128c49f2000cc4fcbc67ed92e4628e45da3
-
Filesize
129B
MD5a526b9e7c716b3489d8cc062fbce4005
SHA12df502a944ff721241be20a9e449d2acd07e0312
SHA256e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
SHA512d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
-
Filesize
232B
MD56358d970c3edccb57eae7dbf9f42d58f
SHA125b994c3b5604f4f67e1ac6250bc2f14ce690380
SHA2569e36401051e677f69a82ab8fbdebd6b16210ee40612c8c7fa45ceb5d7757fe50
SHA51244819fec7e90b903eece750d0a2de531520ed9e637e17e4a57786f9a61c6d4b95ff6072fc3530a9d35d8dc756bcfe20f80a6a07a72d35cf24b305053ae389131
-
Filesize
57B
MD5df5552357692e0cba5e69f8fbf06abb6
SHA14714f1e6bb75a80a8faf69434726d176b70d7bd8
SHA256d158f9d53e7c37eadd3b5cc1b82d095f61484e47eda2c36d9d35f31c0b4d3ff8
SHA512a837555a1175ab515e2b43da9e493ff0ccd4366ee59defe6770327818ca9afa6f3e39ecdf5262b69253aa9e2692283ee8cebc97d58edd42e676977c7f73d143d