Overview
overview
10Static
static
101/0178b79b...bd.exe
windows11-21h2-x64
101/0280cde4...60.exe
windows11-21h2-x64
101/08b76206...65.exe
windows11-21h2-x64
101/0e4fc438...91.exe
windows11-21h2-x64
101/0fb86a8b...05.exe
windows11-21h2-x64
101/25898c73...8f.exe
windows11-21h2-x64
101/2c2e9491...3c.exe
windows11-21h2-x64
101/2ef0f582...2e.exe
windows11-21h2-x64
101/39884fc0...82.exe
windows11-21h2-x64
101/3a72ecec...8a.exe
windows11-21h2-x64
101/3bfcb4f7...71.exe
windows11-21h2-x64
101/4103411f...f5.exe
windows11-21h2-x64
101/4e0fdb84...95.exe
windows11-21h2-x64
31/5297372f...33.exe
windows11-21h2-x64
51/68292f38...e4.exe
windows11-21h2-x64
101/6da4696b...e5.exe
windows11-21h2-x64
71/7021c9cb...78.exe
windows11-21h2-x64
101/752f5cc5...60.exe
windows11-21h2-x64
101/7c7cded8...0c.exe
windows11-21h2-x64
101/97d29ffc...84.exe
windows11-21h2-x64
71/a306cc84...03.exe
windows11-21h2-x64
31/ae1a168f...74.exe
windows11-21h2-x64
71/b13f2364...d6.exe
windows11-21h2-x64
81/b2a1d168...9d.bat
windows11-21h2-x64
81/bb29aeb6...bd.exe
windows11-21h2-x64
81/c8e5a24a...f5.bat
windows11-21h2-x64
81/c9736cdc...97.exe
windows11-21h2-x64
81/d58780d1...a0.exe
windows11-21h2-x64
101/de19e016...d0.exe
windows11-21h2-x64
31/e886016e...51.exe
windows11-21h2-x64
101/f0f496ec...f4.bat
windows11-21h2-x64
81/f28599b0...23.exe
windows11-21h2-x64
10Resubmissions
11-12-2024 15:32
241211-sy44nssrdm 1009-08-2024 21:57
240809-1t1vfs1cpm 1006-08-2024 13:01
240806-p9f97szdlm 1006-08-2024 12:52
240806-p3672stdkg 1006-08-2024 12:29
240806-ppa8fsygqr 1006-08-2024 12:26
240806-pmc92ashlh 10Analysis
-
max time kernel
57s -
max time network
37s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
06-08-2024 12:52
Behavioral task
behavioral1
Sample
1/0178b79bd084c2597b2de4e62e61a88bb8359e4fcac2fe672bb887e0e52e5dbd.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
1/0280cde4a65664a05361129dc1cfa10bc17b3fa9567103ce6eb9d07b06f8f160.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
1/08b7620610fc30c54e5cc095a54ae6d2949f68b0f224c285283e1612c254ef65.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
1/0e4fc438decc9723b89bd0e71b9ee30c1a8390e697d790b2d5ce96e94accd791.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
1/0fb86a8ba8fdf57990c283080a671c1320cbcdfd0e8b5f5a250d9c38a6fce305.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
1/25898c73a877d87ba289bb4ab9585eb36eba9d27d47af678a86befdbf9aa938f.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
1/2c2e949171d86da9b5c58901de2e4a99c4fe86fe92c47556f53b833ce77c503c.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
1/2ef0f582367a7674aef245acb06977bf646419f1f8d05c7fb07881a6102f982e.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
1/39884fc02ed9a51ffcc9b298916be79307f15f1518b6ae2021dd07af0aeecb82.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
1/3a72ecec34a29f53a1d73677a0e6f4c2e19087a32f1808f8f4ff643f62128d8a.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
1/3bfcb4f798ba63a1d18887cb67c90e083d5561a58136a892bd9944528c707671.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
1/4103411f7bb66a033f9f5ce35839ba08b2a27d169e188a911185790f3b78bbf5.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
1/4e0fdb84649ad15a0722789512aaef15c7bfbc4cab82b2a7b0ea52ac9594bb95.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
1/5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
1/68292f388207f8ec69774dbad429e67420881ce46ecfad55f23182ec3a8893e4.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
1/6da4696b804777582ae586a4e9f42f6c18ccf540222d70dcf3374ee291e674e5.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
1/7021c9cba6c224272f01d04450c6c31c93857a21feacfa4295a878a4d7b04378.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
1/752f5cc5a7b0f986286d09e8288c0958bc1b798477ca0d09dc2658c7ab109060.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
1/7c7cded8d1c0784881859ed03340d81c24ea9bf5d9972963cedf0e40b9856a0c.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral20
Sample
1/97d29ffc3556069c807b5c0ae2e2b109ae329feafc912d64f8b7f437bea47d84.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
1/a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral22
Sample
1/ae1a168ff481173d18034d14a767c0801458e95cc3016dc8d82212d0c083a474.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
1/b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
1/b2a1d168dc4234e687d0969b6a1901ac7e69c0d4bb72a1a4c76ba67fa6a14f9d.bat
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
1/bb29aeb6ceecc37829b40e36f91a4620d7e0aae16b1ceea70bb70135e11172bd.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
1/c8e5a24a6d2fa68d7976457a19576b381e6211202500af5280b0f3b256446bf5.bat
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
1/c9736cdc4ade9fddb9b293e0366f182f972154d98169b58e532b7905c310bf97.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral28
Sample
1/d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
1/de19e0163af15585c305f845b90262aee3c2bdf037f9fc733d3f1b379d00edd0.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral30
Sample
1/e886016e48bf0e3cd100d627678f345743509fd5f57f3c9b182f2833352bd451.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
1/f0f496eccc61594c53ded581b6683a77072f607ab018ec0a770a0aa7c7f45ff4.bat
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral32
Sample
1/f28599b06560617bccdfb56acc841f3e642ff51b9956632fcc4204f026711e23.exe
Resource
win11-20240802-en
windows11-21h2-x64
General
-
Target
1/b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
-
Size
808KB
-
MD5
4ac882ebdbc1431cdd3ab45e1712ada1
-
SHA1
b871304fd060b700fd66ce0c87014ec955d12979
-
SHA256
b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6
-
SHA512
f3ff8d00849289436b723bc48c14113e51b583955d7f69870458d7b7d72ba214ad531d601a950b247f43325a610fd15cd6584008fd842a29c1dd0804ee2e6f98
-
SSDEEP
24576:65MOrT+F0sIE9JqsC6mVFyCsffzMS6pcsP9Qtce0TBs/lPsoCyEbDb7Br5oANn90:+bjnS
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\KeHtRITKDkNopIuP\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\KeHtRITKDkNopIuP" b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLoadDriverPrivilege 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3332 wrote to memory of 4660 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 83 PID 3332 wrote to memory of 4660 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 83 PID 3332 wrote to memory of 2040 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 90 PID 3332 wrote to memory of 2040 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 90 PID 3332 wrote to memory of 3536 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 91 PID 3332 wrote to memory of 3536 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 91 PID 3332 wrote to memory of 4964 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 92 PID 3332 wrote to memory of 4964 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 92 PID 3332 wrote to memory of 244 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 93 PID 3332 wrote to memory of 244 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 93 PID 3332 wrote to memory of 4624 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 94 PID 3332 wrote to memory of 4624 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 94 PID 3332 wrote to memory of 2140 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 95 PID 3332 wrote to memory of 2140 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 95 PID 3332 wrote to memory of 3996 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 96 PID 3332 wrote to memory of 3996 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 96 PID 3332 wrote to memory of 2296 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 97 PID 3332 wrote to memory of 2296 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 97 PID 3332 wrote to memory of 1452 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 98 PID 3332 wrote to memory of 1452 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 98 PID 3332 wrote to memory of 2588 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 99 PID 3332 wrote to memory of 2588 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 99 PID 3332 wrote to memory of 2532 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 100 PID 3332 wrote to memory of 2532 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 100 PID 3332 wrote to memory of 2468 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 101 PID 3332 wrote to memory of 2468 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 101 PID 3332 wrote to memory of 1884 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 102 PID 3332 wrote to memory of 1884 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 102 PID 3332 wrote to memory of 1560 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 103 PID 3332 wrote to memory of 1560 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 103 PID 3332 wrote to memory of 4872 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 104 PID 3332 wrote to memory of 4872 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 104 PID 3332 wrote to memory of 5072 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 105 PID 3332 wrote to memory of 5072 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 105 PID 3332 wrote to memory of 5076 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 106 PID 3332 wrote to memory of 5076 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 106 PID 3332 wrote to memory of 5092 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 107 PID 3332 wrote to memory of 5092 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 107 PID 3332 wrote to memory of 2784 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 108 PID 3332 wrote to memory of 2784 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 108 PID 3332 wrote to memory of 3216 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 109 PID 3332 wrote to memory of 3216 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 109 PID 3332 wrote to memory of 1064 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 111 PID 3332 wrote to memory of 1064 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 111 PID 3332 wrote to memory of 4628 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 112 PID 3332 wrote to memory of 4628 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 112 PID 3332 wrote to memory of 1092 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 113 PID 3332 wrote to memory of 1092 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 113 PID 3332 wrote to memory of 4672 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 114 PID 3332 wrote to memory of 4672 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 114 PID 3332 wrote to memory of 624 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 115 PID 3332 wrote to memory of 624 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 115 PID 3332 wrote to memory of 8 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 116 PID 3332 wrote to memory of 8 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 116 PID 3332 wrote to memory of 2332 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 117 PID 3332 wrote to memory of 2332 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 117 PID 3332 wrote to memory of 4404 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 118 PID 3332 wrote to memory of 4404 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 118 PID 3332 wrote to memory of 1608 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 119 PID 3332 wrote to memory of 1608 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 119 PID 3332 wrote to memory of 720 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 120 PID 3332 wrote to memory of 720 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 120 PID 3332 wrote to memory of 3504 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 121 PID 3332 wrote to memory of 3504 3332 b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\1\b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe"C:\Users\Admin\AppData\Local\Temp\1\b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe"1⤵
- Sets service image path in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:4660
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2040
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:3536
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:4964
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:244
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:4624
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2140
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:3996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2296
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:1452
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2588
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2532
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2468
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:1884
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:1560
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:4872
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:5072
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:5076
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:5092
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2784
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:3216
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:1064
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:4628
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:1092
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:4672
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:624
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:8
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2332
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:4404
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:1608
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:720
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:3504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:1992
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:552
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2164
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:4496
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2160
-