Overview
overview
10Static
static
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
7Resubmissions
28-07-2024 16:38
240728-t5tryssgmm 1007-07-2024 14:07
240707-rfgd8atekm 1007-07-2024 14:07
240707-re689awdpe 1013-09-2022 17:54
220913-wg1lpsgbg7 10Analysis
-
max time kernel
1779s -
max time network
1792s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
07-07-2024 14:07
Static task
static1
Behavioral task
behavioral1
Sample
RansomwareSamples/Avaddon_09_06_2020_1054KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
RansomwareSamples/Avaddon_09_06_2020_1054KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
RansomwareSamples/Avos_18_07_2021_403KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
RansomwareSamples/Avos_18_07_2021_403KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
RansomwareSamples/Babik_04_01_2021_31KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
RansomwareSamples/Babik_04_01_2021_31KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
RansomwareSamples/Babuk_20_04_2021_79KB.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
RansomwareSamples/Babuk_20_04_2021_79KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
RansomwareSamples/BlackKingdom_23_03_2021_12460KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
RansomwareSamples/BlackKingdom_23_03_2021_12460KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral11
Sample
RansomwareSamples/BlackMatter_02_08_2021_67KB.exe
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
RansomwareSamples/BlackMatter_02_08_2021_67KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
RansomwareSamples/Conti_22_12_2020_186KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
RansomwareSamples/Conti_22_12_2020_186KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral15
Sample
RansomwareSamples/Cuba_08_03_2021_1130KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
RansomwareSamples/Cuba_08_03_2021_1130KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral17
Sample
RansomwareSamples/DarkSide_01_05_2021_30KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
RansomwareSamples/DarkSide_01_05_2021_30KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral19
Sample
RansomwareSamples/DarkSide_16_01_2021_59KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
RansomwareSamples/DarkSide_16_01_2021_59KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral21
Sample
RansomwareSamples/DarkSide_18_11_2020_17KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
RansomwareSamples/DarkSide_18_11_2020_17KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral23
Sample
RansomwareSamples/DearCry_13_03_2021_1292KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
RansomwareSamples/DearCry_13_03_2021_1292KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral25
Sample
RansomwareSamples/Hades_29_03_2021_1909KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
RansomwareSamples/Hades_29_03_2021_1909KB.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
RansomwareSamples/Hive_17_07_2021_808KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
RansomwareSamples/Hive_17_07_2021_808KB.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
RansomwareSamples/LockBit_14_02_2021_146KB.exe
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
RansomwareSamples/LockBit_14_02_2021_146KB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral31
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win10v2004-20240704-en
General
-
Target
RansomwareSamples/Hive_17_07_2021_808KB.exe
-
Size
808KB
-
MD5
504bd1695de326bc533fde29b8a69319
-
SHA1
67f0c8d81aefcfc5943b31d695972194ac15e9f2
-
SHA256
a0b4e3d7e4cd20d25ad2f92be954b95eea44f8f1944118a3194295c5677db749
-
SHA512
18c5b28bafb13edf47f6a2b803d9d9a914945f037b266a765f2a324842c5ef04ebda27eba31851d2d63e00779a42900e0edfe4ad5bd817eb4f43fa4d4e3a4767
-
SSDEEP
24576:lafTGwLNdRk4RBtr/ioF4/I+CMx3cMt3/4KFG8Qz4YwY:IT7dRFr/ioFjicMtvV4z
Malware Config
Extracted
F:\$RECYCLE.BIN\HOW_TO_DECRYPT.txt
hive
http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/
http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
Signatures
-
Detects Go variant of Hive Ransomware 21 IoCs
Processes:
resource yara_rule behavioral28/memory/4004-865-0x0000000000F10000-0x00000000011E9000-memory.dmp hive_go behavioral28/memory/4004-2733-0x0000000000F10000-0x00000000011E9000-memory.dmp hive_go behavioral28/memory/4004-3489-0x0000000000F10000-0x00000000011E9000-memory.dmp hive_go behavioral28/memory/4004-4232-0x0000000000F10000-0x00000000011E9000-memory.dmp hive_go behavioral28/memory/4004-4981-0x0000000000F10000-0x00000000011E9000-memory.dmp hive_go behavioral28/memory/4004-6249-0x0000000000F10000-0x00000000011E9000-memory.dmp hive_go behavioral28/memory/4004-9141-0x0000000000F10000-0x00000000011E9000-memory.dmp hive_go behavioral28/memory/4004-9907-0x0000000000F10000-0x00000000011E9000-memory.dmp hive_go behavioral28/memory/4004-11851-0x0000000000F10000-0x00000000011E9000-memory.dmp hive_go behavioral28/memory/4004-11876-0x0000000000F10000-0x00000000011E9000-memory.dmp hive_go behavioral28/memory/4004-11877-0x0000000000F10000-0x00000000011E9000-memory.dmp hive_go behavioral28/memory/4004-18145-0x0000000000F10000-0x00000000011E9000-memory.dmp hive_go behavioral28/memory/4004-21786-0x0000000000F10000-0x00000000011E9000-memory.dmp hive_go behavioral28/memory/4004-23184-0x0000000000F10000-0x00000000011E9000-memory.dmp hive_go behavioral28/memory/4004-23189-0x0000000000F10000-0x00000000011E9000-memory.dmp hive_go behavioral28/memory/4004-23196-0x0000000000F10000-0x00000000011E9000-memory.dmp hive_go behavioral28/memory/4004-23203-0x0000000000F10000-0x00000000011E9000-memory.dmp hive_go behavioral28/memory/4004-23211-0x0000000000F10000-0x00000000011E9000-memory.dmp hive_go behavioral28/memory/4004-23216-0x0000000000F10000-0x00000000011E9000-memory.dmp hive_go behavioral28/memory/4004-23223-0x0000000000F10000-0x00000000011E9000-memory.dmp hive_go behavioral28/memory/4004-23268-0x0000000000F10000-0x00000000011E9000-memory.dmp hive_go -
Hive
A ransomware written in Golang first seen in June 2021.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Processes:
description ioc process Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Active Setup\Installed Components -
Drops file in Drivers directory 28 IoCs
Processes:
Hive_17_07_2021_808KB.exedescription ioc process File created C:\Windows\SysWOW64\drivers\it-IT\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\drivers\uk-UA\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\DriverData\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\UMDF\de-DE\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\UMDF\it-IT\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\es-ES\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\ja-JP\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\drivers\de-DE\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\UMDF\es-ES\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\UMDF\ja-JP\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\drivers\es-ES\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\it-IT\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\UMDF\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\en-US\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\drivers\fr-FR\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\drivers\ja-JP\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\UMDF\fr-FR\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\UMDF\uk-UA\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\de-DE\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\etc\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\fr-FR\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\drivers\uk-UA\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe -
Boot or Logon Autostart Execution: Print Processors 1 TTPs 1 IoCs
Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
Processes:
Hive_17_07_2021_808KB.exedescription ioc process File created C:\Windows\System32\spool\prtprocs\x64\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe -
Drops startup file 4 IoCs
Processes:
Hive_17_07_2021_808KB.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.P7EsMTWem2f4DapaPblE9Nbz88yP_gFc7vvnpVOSdzs.hive Hive_17_07_2021_808KB.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral28/memory/4004-0-0x0000000000F10000-0x00000000011E9000-memory.dmp upx behavioral28/memory/4004-865-0x0000000000F10000-0x00000000011E9000-memory.dmp upx behavioral28/memory/4004-2733-0x0000000000F10000-0x00000000011E9000-memory.dmp upx behavioral28/memory/4004-3489-0x0000000000F10000-0x00000000011E9000-memory.dmp upx behavioral28/memory/4004-4232-0x0000000000F10000-0x00000000011E9000-memory.dmp upx behavioral28/memory/4004-4981-0x0000000000F10000-0x00000000011E9000-memory.dmp upx behavioral28/memory/4004-6249-0x0000000000F10000-0x00000000011E9000-memory.dmp upx behavioral28/memory/4004-9141-0x0000000000F10000-0x00000000011E9000-memory.dmp upx behavioral28/memory/4004-9907-0x0000000000F10000-0x00000000011E9000-memory.dmp upx behavioral28/memory/4004-11851-0x0000000000F10000-0x00000000011E9000-memory.dmp upx behavioral28/memory/4004-11876-0x0000000000F10000-0x00000000011E9000-memory.dmp upx behavioral28/memory/4004-11877-0x0000000000F10000-0x00000000011E9000-memory.dmp upx behavioral28/memory/4004-18145-0x0000000000F10000-0x00000000011E9000-memory.dmp upx behavioral28/memory/4004-21786-0x0000000000F10000-0x00000000011E9000-memory.dmp upx behavioral28/memory/4004-23184-0x0000000000F10000-0x00000000011E9000-memory.dmp upx behavioral28/memory/4004-23189-0x0000000000F10000-0x00000000011E9000-memory.dmp upx behavioral28/memory/4004-23196-0x0000000000F10000-0x00000000011E9000-memory.dmp upx behavioral28/memory/4004-23203-0x0000000000F10000-0x00000000011E9000-memory.dmp upx behavioral28/memory/4004-23211-0x0000000000F10000-0x00000000011E9000-memory.dmp upx behavioral28/memory/4004-23216-0x0000000000F10000-0x00000000011E9000-memory.dmp upx behavioral28/memory/4004-23223-0x0000000000F10000-0x00000000011E9000-memory.dmp upx behavioral28/memory/4004-23268-0x0000000000F10000-0x00000000011E9000-memory.dmp upx -
Drops desktop.ini file(s) 64 IoCs
Processes:
Hive_17_07_2021_808KB.exedescription ioc process File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\Documents\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Public\Downloads\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Public\Pictures\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Public\Music\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\Links\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Public\Libraries\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Public\Videos\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Public\Desktop\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\Searches\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\Videos\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Public\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Public\Documents\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini Hive_17_07_2021_808KB.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini Hive_17_07_2021_808KB.exe -
Drops file in System32 directory 64 IoCs
Processes:
Hive_17_07_2021_808KB.exedescription ioc process File created C:\Windows\SysWOW64\Speech\SpeechUX\es-ES\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SecureBoot\de-DE\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\vhdmp.inf_amd64_aa94d04ecf56de1f\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\es-ES\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0804\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\uk-UA\Licenses\Volume\Professional\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmusrg.inf_amd64_bb7c44c7bb3664d0\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\es-ES\Licenses\Volume\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\wbem\Repository\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\Printing_Admin_Scripts\ja-JP\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\_Default\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\_Default\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\iai2c.inf_amd64_a77c815b2999404d\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcrtix.inf_amd64_e3ded2b26d662526\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\IME\IMEKR\APPLETS\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\Tasks\Microsoft\Windows\PLA\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\fr-FR\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\spool\drivers\W32X86\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\it-IT\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\c_unknown.inf_amd64_9f92c189b415c003\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\hal.inf_amd64_fd0ae947345ac7bf\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\rdpbus.inf_amd64_05ebd3b4422f62ba\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\Speech\Common\fr-FR\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\Tasks\Microsoft\OneCore\DirectX\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Whea\en-US\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\migwiz\replacementmanifests\WindowsSearchEngine\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\de-DE\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\sppui\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\Speech\Common\en-US\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\spp\tokens\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fscopyprotection.inf_amd64_9c108d8ac558a80d\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmfj2.inf_amd64_167948d0c94abc27\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\stornvme.inf_amd64_1218fad01506b7af\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\tsusbhub.inf_amd64_bd91a147ab4ebf1c\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\Modules\NetworkSwitchManager\fr-FR\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\Com\dmp\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\Licenses\neutral\OEM\Professional\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\_Default\Professional\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\c_extension.inf_amd64_7891c7d003f5e96b\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\fidohid.inf_amd64_c446be9403cdcdb1\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\Speech\SpeechUX\uk-UA\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\WCN\ja-JP\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Kds\en-US\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\config\systemprofile\AppData\Local\tw-c28-c2c-2f6b.tmp\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\ko-KR\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\Tasks\Microsoft\Windows\PLA\System\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\en-US\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\Boot\en-US\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\Configuration\Registration\MSFT_FileDirectoryConfiguration\ja-JP\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\bthleenum.inf_amd64_11f9ff6c12dbf9b5\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\InputMethod\CHT\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\config\systemprofile\AppData\Local\tw-d60-d90-a182.tmp\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\rspndr.inf_amd64_4e80c2bb5314f071\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\Speech\Engines\SR\fr-FR\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{6f126544-600f-4756-8792-b71c4e30f413}\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\en-US\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\pl-PL\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fsencryption.inf_amd64_b4b4845819a23338\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\fr-FR\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\uk-UA\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Hive_17_07_2021_808KB.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.P7EsMTWem2f4DapaPblE9JLMqb0GT-MsqSXfDBplsgc.hive Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.scale-400.png Hive_17_07_2021_808KB.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\ui-strings.js Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL002.XML Hive_17_07_2021_808KB.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pt-br\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONBttnPPT.dll Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\202.png Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-60_altform-unplated.png Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSplashLogo.scale-250.png Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter-hover_32.svg Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\PREVIEW.GIF.P7EsMTWem2f4DapaPblE9BlnkxlS9YQllD3nUpaK9Eo.hive Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\resources.pak.DATA.P7EsMTWem2f4DapaPblE9PSmXvAta_JqUP56tyeEGTo.hive Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsMedTile.contrast-black_scale-125.png Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Applications.Telemetry.Windows.dll Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailSmallTile.scale-150.png Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.SecureString.dll Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\msipc.dll.mui.P7EsMTWem2f4DapaPblE9AuHrQaaDXlDVGqGIllTijo.hive Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSGet.Format.ps1xml Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\nl_get.svg Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_wasapi_plugin.dll Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml Hive_17_07_2021_808KB.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ar-ae\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GADUGIB.TTF.P7EsMTWem2f4DapaPblE9N9WkJwDaKIFhphO3V9SeQ4.hive Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-runtime-l1-1-0.dll Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_contrast-black.png Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\zlibwapi.dll.P7EsMTWem2f4DapaPblE9FAK8e5LuWsFN3tP-2Rk0wc.hive Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\ro.pak.P7EsMTWem2f4DapaPblE9OxFCp75q308UWmFVzVcogg.hive Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\NewNotePlaceholder-dark.png Hive_17_07_2021_808KB.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-ma\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.P7EsMTWem2f4DapaPblE9Iug6pFcybIlgFi-LU92Yhw.hive Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Runtime.InteropServices.dll Hive_17_07_2021_808KB.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-sl\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailLargeTile.scale-125.png Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.tree.dat.P7EsMTWem2f4DapaPblE9PELDBezftc1xes91Op6jBs.hive Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-right.gif.P7EsMTWem2f4DapaPblE9IPXwRs6EwMqDK5EsTxwVUA.hive Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ja-jp\ui-strings.js.P7EsMTWem2f4DapaPblE9CEvoU-M2td-iXWpVvrfvGg.hive Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\PackageManagementDscUtilities.strings.psd1.P7EsMTWem2f4DapaPblE9PZJe1ZgBUwtbzbv8rzUuBc.hive Hive_17_07_2021_808KB.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Controls\EndOfLife\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteWideTile.scale-125.png Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sortedby_hover_18.svg Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_field_grabber.png.P7EsMTWem2f4DapaPblE9O_MlC_RsF44NXcIPKcbIwc.hive Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteSmallTile.scale-150.png Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\IC_WelcomeBanner.scale-100.png Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\decora_sse.dll.P7EsMTWem2f4DapaPblE9PD0BmXDN7JX9keKpkGeX1o.hive Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-30_altform-unplated_contrast-white.png Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MEIPreload\preloaded_data.pb.DATA.P7EsMTWem2f4DapaPblE9Ou3jzKHGGsk_4I_XnnhIEA.hive Hive_17_07_2021_808KB.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ppd.xrm-ms Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXC Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_PigNose.png Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_ur.dll Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationFramework.resources.dll.P7EsMTWem2f4DapaPblE9DGMyl3gAfgbESWq6F7fSiQ.hive Hive_17_07_2021_808KB.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\prism_common.dll.P7EsMTWem2f4DapaPblE9HXDaPkZ-gZv9DM0I8sk2xE.hive Hive_17_07_2021_808KB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.Preview.winmd Hive_17_07_2021_808KB.exe -
Drops file in Windows directory 64 IoCs
Processes:
Hive_17_07_2021_808KB.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-d..lowbroker.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_521d56dcb4ef479b\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-hlink_31bf3856ad364e35_10.0.19041.1237_none_d6d991394db08f86\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ac-ado-ddl-security_31bf3856ad364e35_10.0.19041.264_none_9a64e210d3a49e6c\r\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dafwfdprovider_31bf3856ad364e35_10.0.19041.1_none_b058c457605b2980\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-k..l-pnp-adm.resources_31bf3856ad364e35_10.0.19041.1_it-it_e961f8e21ea93e0a\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..mentmanifests-shell_31bf3856ad364e35_10.0.19041.423_none_9e37e96dfd85e9b1\r\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapcontrol-desktop_31bf3856ad364e35_10.0.19041.746_none_2999d52b8db06219\f\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_windows-id-connecte..nt-provider-activex_31bf3856ad364e35_10.0.19041.1_none_211e6839b16031fe\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..rity-domain-clients_31bf3856ad364e35_10.0.19041.1_none_db2033aec5f4055d\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000044b_31bf3856ad364e35_10.0.19041.1_none_b2edb67cf59d8460\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup.resources_31bf3856ad364e35_11.0.19041.1_uk-ua_651962b808b5b764\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certutil.resources_31bf3856ad364e35_10.0.19041.1_es-es_85df3743bdb65309\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_10.0.19041.1023_en-us_7aca3dab28c636fc\f\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\x86_system.printing_31bf3856ad364e35_10.0.19041.1_none_cd12d4bd5d1c62ec\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdm-adm_31bf3856ad364e35_10.0.19041.1_none_afd04b8235cdb4f2\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\assembly\GAC_MSIL\System.ServiceModel.Resources\3.0.0.0_it_b77a5c561934e089\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.19041.928_none_0b17415ae0dd0379\r\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.19041.1_en-us_57d193173da3f87b\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..clientapi.resources_31bf3856ad364e35_10.0.19041.1_de-de_9b306a53cd56cfa2\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devices-wifidirect_31bf3856ad364e35_10.0.19041.264_none_7507f2201fb551a4\r\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\msil_system.serviceprocess.resources_b03f5f7f11d50a3a_10.0.19041.1_it-it_ae68d65583e97eab\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\msil_microsoft.powershell.security.resources_31bf3856ad364e35_1.0.0.0_ja-jp_81063264f1136d5e\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\wow64_windows-media-speech-winrt_31bf3856ad364e35_10.0.19041.264_none_fbb15bbadd313556\r\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..roxy-main.resources_31bf3856ad364e35_10.0.19041.1_en-us_3813956db567ed0e\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.19041.1151_none_c86feb6936a97173\r\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig.resources\v4.0_4.0.0.0_es_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..pprovider.resources_31bf3856ad364e35_10.0.19041.1_es-es_41e0d1946a7c5321\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\msil_system.messaging.resources_b03f5f7f11d50a3a_10.0.19041.1_de-de_917d3b2b93fb8e53\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-payments_31bf3856ad364e35_10.0.19041.746_none_3c6d03c57404e0f9\f\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directui.resources_31bf3856ad364e35_10.0.19041.1023_pt-br_e4a05bc207bb3d6f\r\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\x86_microsoft-windows-mediaplayer-wmvcore_31bf3856ad364e35_10.0.19041.1202_none_1fd41533d2b067a4\f\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..2provider.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_02970791e1e5a4d5\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..airingdll.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_a49ef473cdccb95c\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..dac-rds-persist-dll_31bf3856ad364e35_10.0.19041.1_none_4a9e393bc6b3251b\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-f12app_31bf3856ad364e35_11.0.19041.746_none_3439cbf8eff84ce1\f\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_dual_input.inf_31bf3856ad364e35_10.0.19041.868_none_06aed3f048cb8494\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicepropertymanager_31bf3856ad364e35_10.0.19041.746_none_9ae154761e6a5add\f\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Composition.Registration.resources\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-powercpl_31bf3856ad364e35_10.0.19041.423_none_3fecd70fd2fa0d37\r\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-filter.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_1b28da3746b5dd0d\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..systemmanufacturers_31bf3856ad364e35_10.0.19041.746_none_4d8cd7989326ef85\f\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.264_none_31474dbf12ce5adc\r\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-api_31bf3856ad364e35_10.0.19041.1266_none_2b4b7ff44edc4a8b\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\INF\BITS\0411\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0409\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-aero.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_92ba62f3ec5ae25c\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wpd-busenumservice_31bf3856ad364e35_10.0.19041.1_none_2def3dd96b5fea95\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Composition.Registration.resources\v4.0_4.0.0.0_it_b77a5c561934e089\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.19041.153_none_c283d2cf01b0b7d8\r\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-kernelbase_31bf3856ad364e35_10.0.19041.1288_none_a61ec92f9e248eae\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmpnss-publicapi_31bf3856ad364e35_10.0.19041.746_none_69467668c56fda1a\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.789_none_3136b8d712da0334\r\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nter-core.resources_31bf3856ad364e35_10.0.19041.1_it-it_bb104a70cd466cf6\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ransformers-onecore_31bf3856ad364e35_10.0.19041.262_none_023656085a635caf\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-inputdll.resources_31bf3856ad364e35_10.0.19041.1_es-es_34064879a57dffb3\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..k-softkbd.resources_31bf3856ad364e35_10.0.19041.1_de-de_308c961abd2def42\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-flacencoder_31bf3856ad364e35_10.0.19041.746_none_fcdcc022ec231bfa\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.InteropServices.WindowsRuntime\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-driverquery.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_5586251554a4ddb1\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..dem-voice.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_50c12c5e7b6751b7\HOW_TO_DECRYPT.txt Hive_17_07_2021_808KB.exe -
Delays execution with timeout.exe 64 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 3880 2060 3640 1492 timeout.exe 3240 timeout.exe 1864 timeout.exe 1552 2472 1560 3172 timeout.exe 4292 3152 2980 3824 1624 1820 4956 2500 3516 2480 4360 3588 4560 4620 2360 3984 1108 2504 3096 4392 4072 300 timeout.exe 4308 timeout.exe 2640 3152 3440 2808 timeout.exe 3816 4372 2764 timeout.exe 1768 2168 2020 4272 2568 3448 4808 1692 3520 2332 3596 4188 1364 1808 464 1652 1976 4500 2568 4344 3068 4132 timeout.exe 2472 timeout.exe 4444 -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 976 vssadmin.exe -
Modifies registry class 3 IoCs
Processes:
description ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2539840389-1261165778-1087677076-1000\{3DE2B3E7-739B-41F5-8C14-BBC5AECCDC21} Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\MuiCache -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Hive_17_07_2021_808KB.exepid process 4004 Hive_17_07_2021_808KB.exe 4004 Hive_17_07_2021_808KB.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2812 vssvc.exe Token: SeRestorePrivilege 2812 vssvc.exe Token: SeAuditPrivilege 2812 vssvc.exe Token: SeShutdownPrivilege 4944 Token: SeCreatePagefilePrivilege 4944 Token: SeShutdownPrivilege 4944 Token: SeCreatePagefilePrivilege 4944 Token: SeShutdownPrivilege 4944 Token: SeCreatePagefilePrivilege 4944 Token: SeShutdownPrivilege 4944 Token: SeCreatePagefilePrivilege 4944 Token: SeShutdownPrivilege 4944 Token: SeCreatePagefilePrivilege 4944 Token: SeShutdownPrivilege 4944 Token: SeCreatePagefilePrivilege 4944 -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
pid process 4944 4944 4944 4944 4944 4944 -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
pid process 4944 4944 4944 4944 4944 4944 4944 4944 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Hive_17_07_2021_808KB.execmd.execmd.exedescription pid process target process PID 4004 wrote to memory of 3700 4004 Hive_17_07_2021_808KB.exe cmd.exe PID 4004 wrote to memory of 3700 4004 Hive_17_07_2021_808KB.exe cmd.exe PID 4004 wrote to memory of 1860 4004 Hive_17_07_2021_808KB.exe cmd.exe PID 4004 wrote to memory of 1860 4004 Hive_17_07_2021_808KB.exe cmd.exe PID 3700 wrote to memory of 3364 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 3364 3700 cmd.exe timeout.exe PID 1860 wrote to memory of 976 1860 cmd.exe vssadmin.exe PID 1860 wrote to memory of 976 1860 cmd.exe vssadmin.exe PID 3700 wrote to memory of 3652 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 3652 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 680 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 680 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 2992 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 2992 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 1572 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 1572 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 2148 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 2148 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 4444 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 4444 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 2160 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 2160 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 4528 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 4528 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 1784 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 1784 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 3148 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 3148 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 3944 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 3944 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 2108 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 2108 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 952 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 952 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 1804 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 1804 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 3988 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 3988 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 4736 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 4736 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 2328 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 2328 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 116 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 116 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 1368 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 1368 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 1616 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 1616 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 4760 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 4760 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 4660 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 4660 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 2220 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 2220 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 1496 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 1496 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 752 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 752 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 3116 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 3116 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 1364 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 1364 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 888 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 888 3700 cmd.exe timeout.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Hive_17_07_2021_808KB.exe"C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Hive_17_07_2021_808KB.exe"1⤵
- Drops file in Drivers directory
- Boot or Logon Autostart Execution: Print Processors
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c hive.bat >NUL 2>NUL2⤵
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\system32\timeout.exetimeout 13⤵PID:3364
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3652
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:680
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2992
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1572
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2148
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4444
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2160
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4528
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1784
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3148
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3944
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2108
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:952
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1804
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3988
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4736
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2328
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:116
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1368
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1616
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4760
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4660
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2220
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1496
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:752
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3116
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1364
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:888
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4852
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2484
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1456
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3196
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4556
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2396
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4272
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3688
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3184
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1416
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2552
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1732
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4628
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3476
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1808
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4076
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3772
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4132
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2772
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2808 -
C:\Windows\system32\timeout.exetimeout 13⤵PID:948
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4936
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1136
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2124
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4500
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3504
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3244
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2936
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:920
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4316
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4192
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1572
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3628
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:292
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2964
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1228
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2348
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3324
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4532
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5020
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3916
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:652
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3968
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2256
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1464
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4724
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4328
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5004
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:952
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4468
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4536
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4568
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2292
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4620
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1880
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:832
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3444
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1368
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5016
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:388
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2316
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4668
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3972
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1812
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1272
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3136
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2060
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4516
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:964
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2484
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3472
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4956
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1652
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2480
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2684
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1932
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:996
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4800
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4452
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2772
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4460
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4120
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2620
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3404
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2936
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2500
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1964
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3824
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:304
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2964
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4056
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1228
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3324
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4860
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3820
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3768
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3068
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3248
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5084
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1464
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2596
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4348
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1276
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4368
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3592
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:812
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2360
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1772
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4760
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:388
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3624
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2220
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4440
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1280
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1272
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1168
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:900
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3488
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4852
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:924
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5032
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3096
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4956
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2396
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1060
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3216
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1888
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2552
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2544
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3476
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1440
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4592
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4800
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3368
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4132
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4012
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1144
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1952
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5076
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1956
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2852
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2240
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3176
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2864
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4280
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4232
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4808
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:284
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3824
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4780
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:220
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4056
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2132
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3576
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4676
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5020
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2476
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3068
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3608
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4952
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3148
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4328
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2596
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1088
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2292
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:320
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4584
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3656
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1864
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1772
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:100
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4300
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3624
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4944
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1204
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3256
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1252
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2944
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4856
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1736
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1260
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:512
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2484
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5032
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4656
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3240
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2396
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4240
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2480
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4624
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1820
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2552
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4628
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1808
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3252
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4304
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:4132 -
C:\Windows\system32\timeout.exetimeout 13⤵PID:4356
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4524
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2792
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4652
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3736
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1072
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3652
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3712
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2992
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4420
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2500
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:268
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:304
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2964
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1228
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3572
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4860
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1264
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1240
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5020
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4528
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3468
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1784
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:3172 -
C:\Windows\system32\timeout.exetimeout 13⤵PID:3248
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2916
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1248
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:880
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2904
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2596
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2292
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1880
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4756
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1676
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2152
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4960
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1052
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:100
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2220
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1868
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2952
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:752
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2432
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5036
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4516
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3440
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4484
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1260
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:512
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3076
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3472
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4924
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4876
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4956
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:3240 -
C:\Windows\system32\timeout.exetimeout 13⤵PID:3688
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2396
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3184
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4580
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4984
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1304
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2680
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1660
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4028
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4256
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4356
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1236
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1136
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:628
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3736
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2240
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3244
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3652
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4412
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4232
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2200
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:292
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4780
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2476
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1784
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5056
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1960
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3396
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2108
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1644
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4508
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:368
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4736
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:320
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2900
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4584
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1368
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2452
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2324
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2724
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3624
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2232
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5048
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2952
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:752
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4796
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2060
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4332
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4212
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1564
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1736
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4456
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3096
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4556
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:916
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3996
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2416
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1768
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1820
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2504
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1440
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3368
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:948
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4612
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5076
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4100
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2852
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3504
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:680
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3984
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4412
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3628
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3748
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2880
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2964
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4884
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3576
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4788
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3496
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5068
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:244
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5080
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3172
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3128
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4328
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4520
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3988
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4736
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2900
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4392
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1616
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4972
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1656
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:100
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2128
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3436
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5036
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2204
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4872
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2236
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1112
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3688
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1492 -
C:\Windows\system32\timeout.exetimeout 13⤵PID:1820
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1484
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4012
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4936
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2980
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2936
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4192
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:304
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4384
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2132
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3820
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5068
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1960
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2884
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4508
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3200
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1864 -
C:\Windows\system32\timeout.exetimeout 13⤵PID:4300
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2220
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3624
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3156
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4216
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:900
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4728
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3832
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2484
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5008
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4536
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3688
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1768
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:996
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:316
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1144
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:948
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4652
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3404
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2864
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2088
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2948
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2296
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:300 -
C:\Windows\system32\timeout.exetimeout 13⤵PID:3824
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4384
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3668
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4528
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5080
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2108
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1088
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:320
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4320
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1864
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4300
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1868
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3256
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1364
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4852
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4484
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2044
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2396
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3688
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1492
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4288
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1948
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1144
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1136
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3504
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2992
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4232
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1700
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3952
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4676
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2536
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5056
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3172
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3128
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4620
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4324
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:640
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1204
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3104
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4752
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:272
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4008
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4844
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4596
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2684
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1768
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1492
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4136
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2228
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3008
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3480
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4500
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3176
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4848
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1724
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4192
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1692
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1696
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1228
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2888
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:940
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1784
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3608
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3500
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3028
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2916
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3336
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:952
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2108
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2596
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4508
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4620
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:832
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4756
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4392
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:388
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4972
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2304
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:640
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2220
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3956
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1204
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2060
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4216
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4360
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4212
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4332
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:964
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3112
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3152
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:512
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2484
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3472
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4008
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4876
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:916
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1416
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1732
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1996
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2224
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2368
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2352
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2504
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1460
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4840
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:316
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4132
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:4308 -
C:\Windows\system32\timeout.exetimeout 13⤵PID:3008
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3888
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5076
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:872
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4120
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3204
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2240
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3768
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:680
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3984
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2992
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4848
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:296
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2296
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1724
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1700
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1692
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2880
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3948
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3952
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1228
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4176
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4776
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2888
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2020
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4088
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3068
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5068
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4504
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3500
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4952
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2876
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1412
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2884
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3336
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3128
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4520
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2844
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3988
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:116
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1620
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4584
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5016
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1772
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:388
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4960
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2924
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2280
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2724
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1868
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4476
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2572
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2944
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4180
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4516
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2392
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:272
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2204
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4484
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3196
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4456
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4008
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2216
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4536
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3464
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2300
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1996
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4624
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3676
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4076
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:996
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1440
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4840
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1484
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4256
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3368
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:336
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2792
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2852
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:872
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2980
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2240
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3768
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3652
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2936
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4576
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:284
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4404
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2200
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:308
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:292
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2340
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4780
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1692
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4444
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4824
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3576
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5012
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4776
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3396
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2476
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3068
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1784
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4504
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4724
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2884
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2108
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4736
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1376
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4756
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:224
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4440
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3972
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1812
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2660
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4856
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3488
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2764 -
C:\Windows\system32\timeout.exetimeout 13⤵PID:3528
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3184
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1112
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1312
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2368
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2504
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4452
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4012
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2308
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4612
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1072
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4120
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3736
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3640
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:920
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4280
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3412
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:280
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4412
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4404
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2200
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:268
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3824
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1700
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2144
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2880
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4056
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4868
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3324
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3916
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5012
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2164
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1912
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:968
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3968
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5068
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4504
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3804
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4952
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3944
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1412
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2772
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2884
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4836
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1372
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2844
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3592
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:116
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2900
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4584
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4320
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2152
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4760
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:388
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1052
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:756
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:100
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:640
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2220
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5048
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2952
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3136
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1252
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1168
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:232
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5040
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2572
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2944
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4180
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4856
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4752
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1260
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1456
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:272
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1872
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:512
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3196
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4456
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4272
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3996
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1416
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3184
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2416
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2300
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1304
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1996
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2544
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4592
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3676
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3772
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1492
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4648
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:368
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4452
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4308
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4012
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3008
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5076
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3888
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2852
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3404
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2980
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2240
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:920
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4280
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2500
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:300
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1724
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4284
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2144
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3600
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4884
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3324
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1240
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2020
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3532
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5056
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4208
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1464
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1276
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2884
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3596
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4836
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4364
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:832
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2472 -
C:\Windows\system32\timeout.exetimeout 13⤵PID:3884
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1620
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:212
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2316
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4960
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4948
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:756
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4400
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:640
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1272
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3956
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1000
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4796
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1168
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:232
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5040
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2572
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1576
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4180
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4852
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4752
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3832
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3076
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2764
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3472
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5032
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2236
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4656
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4060
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1732
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4596
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2552
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4628
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1932
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4624
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4076
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1924
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4312
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1484
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4840
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4460
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4308
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3664
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2308
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5076
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:628
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4120
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3736
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3768
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3652
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4344
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:920
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4808
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4848
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3628
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2296
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2200
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4780
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1696
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2348
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4824
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4860
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3668
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3496
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3248
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2592
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3588
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4468
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1464
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2772
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:952
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4520
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1088
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1372
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2108
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4620
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4364
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3444
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4928
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2472
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4392
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2152
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4760
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1772
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4976
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4960
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4300
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3624
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4440
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1272
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3136
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3436
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2944
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4332
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4852
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1444
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4872
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3076
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2484
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3472
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4844
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4456
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:220
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3060
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2300
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1312
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1768
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1932
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4624
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1924
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1440
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2228
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4460
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3008
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4100
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:948
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3712
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3768
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3984
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4808
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4764
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2500
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4404
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1724
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1696
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3668
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:968
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3028
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3128
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4192
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4508
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2108
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4736
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3940
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:832
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2360
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1620
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4932
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1052
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4944
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1740
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1812
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4436
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2572
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4728
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3440
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3836
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4752
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2764
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3196
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2216
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4656
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2396
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3688
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4628
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1460
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4648
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2064
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1236
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1136
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2852
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3736
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4316
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:920
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:300
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:304
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2200
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2144
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4868
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1560
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1912
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3092
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1624
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4468
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1412
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3324
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4368
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2740
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1880
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3988
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2108
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4736
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4584
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4392
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1620
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4244
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:732
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2316
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2304
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2724
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3972
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1868
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3136
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5040
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4436
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2572
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4728
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1736
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3836
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5008
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4828
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5032
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4876
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:916
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3464
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1416
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2416
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2456
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2300
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2368
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3252
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4492
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3772
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1948
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4136
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1484
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4840
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4308
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3664
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5076
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2792
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2412
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3404
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3176
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3736
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1292
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4280
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1976
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1572
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1352
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:268
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2880
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3948
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2700
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:1264
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:3952
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2476
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:2256
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:5056
-
C:\Windows\system32\timeout.exetimeout 13⤵PID:4048
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c shadow.bat >NUL 2>NUL2⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:976
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2812
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵PID:3916
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 0afeecc500f731ad21de2ce7b24e1d79 X8jK9B9SSUivmUh7Jvn8SQ.0.1.0.0.01⤵PID:1000
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Print Processors
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Print Processors
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5f66bd8c4a0c3f208d38e64628d9a329d
SHA142b37f09b12463003ad23b3aa0e68c77d0aef3f8
SHA2564bd462a2312dabd402bbeb87bf13e933ac47284ff027d547cf46fdab7e13791b
SHA512fec4fc2f2a91f04ab87225020f12f2bddc1a0316a482d041999b6293e8e4ca0f8ce6b9a0dbaae61089c2a5909ef0ef5e27a51c7912fb1b3318b6aad950e9e4d7
-
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.P7EsMTWem2f4DapaPblE9Dlz_RIz8E18M8Wn___Y6AI.hive
Filesize622KB
MD59e95c9286aa916de80a68960ed66b52d
SHA1f2f8c6fd0ea28bca1a63cd2594afc3942b416c3f
SHA25608ceabcb4f55ab059a42a4588e67b9aac327e3fe45047927a1fa7b30861a0576
SHA5121884c4398cbd4f7300ca03a25b1fcc814a8d2809dd438409ac9e2d1ca764569e55c6bfc60235949dade710ce0549fcbf41b929179f677219e076a895fd8d5db1
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133648406469969338.txt
Filesize2KB
MD5ecaea544af9da1114077b951d8cb520d
SHA15820b2d71e7b2543cf1804eb91716c4e9f732fde
SHA2569117b26ab2c8fdbb8223fe1f2d1770c50a6cf0d9849a5849d6aebcbe90435be6
SHA512dc7bedbc581818011aa2d313429f234b12e5e9cf320b02b8d7ceeaf9cdc1c921ffc51af7f4080b02740f2d2146fbb006ccbf37cdcba3e3a10009142daffdb919
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
Filesize1KB
MD5c9c0dfee4ea69bbc4edbbd1684c97f7d
SHA11fb65f2c4b44b8c8795a8f3b7303137869d4a132
SHA256dc7ada2e6705249f64ee7a50ad5c268ea469a38d691d05b32991ca3bb426d380
SHA512a4c6b4bd7c21b9e54feb21e8fbf62debd93c9eb41da683156d11a24e93283e14628160780b6130df5e27704d8a5ec0bd87244d2e03c8cb735fd7809749abe5f5
-
Filesize
232B
MD56358d970c3edccb57eae7dbf9f42d58f
SHA125b994c3b5604f4f67e1ac6250bc2f14ce690380
SHA2569e36401051e677f69a82ab8fbdebd6b16210ee40612c8c7fa45ceb5d7757fe50
SHA51244819fec7e90b903eece750d0a2de531520ed9e637e17e4a57786f9a61c6d4b95ff6072fc3530a9d35d8dc756bcfe20f80a6a07a72d35cf24b305053ae389131
-
Filesize
57B
MD5df5552357692e0cba5e69f8fbf06abb6
SHA14714f1e6bb75a80a8faf69434726d176b70d7bd8
SHA256d158f9d53e7c37eadd3b5cc1b82d095f61484e47eda2c36d9d35f31c0b4d3ff8
SHA512a837555a1175ab515e2b43da9e493ff0ccd4366ee59defe6770327818ca9afa6f3e39ecdf5262b69253aa9e2692283ee8cebc97d58edd42e676977c7f73d143d
-
Filesize
1KB
MD5ee4ad142674725d6d9b58c9c3bb836dc
SHA1ac9bac37131c72a549d2bf3fbd233061906d5fab
SHA256fc1f1ed6a6692d18788de47420ead7e8a1b534b015db69a39052a0a2fc30c776
SHA512a34c547d13880b578703f52b7d3d61b1893536966204d80a9e0f60aee8851bd9f70e3d0ceb1601aa11901c6315f57128c49f2000cc4fcbc67ed92e4628e45da3