Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 19:28
Static task
static1
Behavioral task
behavioral1
Sample
513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe
Resource
win10v2004-20240802-en
General
-
Target
513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe
-
Size
477KB
-
MD5
e931ab5882d62ea08e498d90e2e11ad0
-
SHA1
5b68fe6556752d6bf077740d1b297f65a2673b54
-
SHA256
513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425
-
SHA512
f12285f65854fbce23b6c4fee6ef662cb61d65b874f17347494c1d0c9984c24acb4c1d703d7821b482864e271d08ccfce73e40a4cff9112d9907fea527ab6042
-
SSDEEP
3072:/NV+7SXjtEjDg/s6L7h/gT72ZywWWq/ePVl/uw7cFh:/TwSXNUQmkWWjzcF
Malware Config
Signatures
-
HelloKitty Ransomware
Ransomware family which has been active since late 2020, and in early 2021 a variant compromised the CDProjektRed game studio.
-
Renames multiple (191) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2208 net.exe 2028 net1.exe -
Kills process with taskkill 35 IoCs
pid Process 796 taskkill.exe 2604 taskkill.exe 1724 taskkill.exe 588 taskkill.exe 2740 taskkill.exe 2724 taskkill.exe 2192 taskkill.exe 2068 taskkill.exe 3068 taskkill.exe 2340 taskkill.exe 2328 taskkill.exe 2164 taskkill.exe 2728 taskkill.exe 2432 taskkill.exe 2620 taskkill.exe 320 taskkill.exe 1352 taskkill.exe 1480 taskkill.exe 2944 taskkill.exe 3004 taskkill.exe 1876 taskkill.exe 1960 taskkill.exe 1688 taskkill.exe 2228 taskkill.exe 1840 taskkill.exe 1644 taskkill.exe 2804 taskkill.exe 2092 taskkill.exe 2824 taskkill.exe 2848 taskkill.exe 824 taskkill.exe 2696 taskkill.exe 1696 taskkill.exe 788 taskkill.exe 972 taskkill.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 2340 taskkill.exe Token: SeDebugPrivilege 796 taskkill.exe Token: SeDebugPrivilege 2164 taskkill.exe Token: SeDebugPrivilege 2328 taskkill.exe Token: SeDebugPrivilege 2728 taskkill.exe Token: SeDebugPrivilege 2228 taskkill.exe Token: SeDebugPrivilege 2740 taskkill.exe Token: SeDebugPrivilege 2848 taskkill.exe Token: SeDebugPrivilege 2432 taskkill.exe Token: SeDebugPrivilege 2620 taskkill.exe Token: SeDebugPrivilege 320 taskkill.exe Token: SeDebugPrivilege 1352 taskkill.exe Token: SeDebugPrivilege 2604 taskkill.exe Token: SeDebugPrivilege 2724 taskkill.exe Token: SeDebugPrivilege 1724 taskkill.exe Token: SeDebugPrivilege 1840 taskkill.exe Token: SeDebugPrivilege 1644 taskkill.exe Token: SeDebugPrivilege 2192 taskkill.exe Token: SeDebugPrivilege 2092 taskkill.exe Token: SeDebugPrivilege 2804 taskkill.exe Token: SeDebugPrivilege 2068 taskkill.exe Token: SeDebugPrivilege 1480 taskkill.exe Token: SeDebugPrivilege 2944 taskkill.exe Token: SeDebugPrivilege 2824 taskkill.exe Token: SeDebugPrivilege 2696 taskkill.exe Token: SeDebugPrivilege 824 taskkill.exe Token: SeDebugPrivilege 3004 taskkill.exe Token: SeDebugPrivilege 588 taskkill.exe Token: SeDebugPrivilege 1696 taskkill.exe Token: SeDebugPrivilege 1876 taskkill.exe Token: SeDebugPrivilege 3068 taskkill.exe Token: SeDebugPrivilege 788 taskkill.exe Token: SeDebugPrivilege 972 taskkill.exe Token: SeDebugPrivilege 1960 taskkill.exe Token: SeDebugPrivilege 1688 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 828 wrote to memory of 796 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 31 PID 828 wrote to memory of 796 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 31 PID 828 wrote to memory of 796 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 31 PID 828 wrote to memory of 796 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 31 PID 828 wrote to memory of 2340 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 33 PID 828 wrote to memory of 2340 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 33 PID 828 wrote to memory of 2340 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 33 PID 828 wrote to memory of 2340 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 33 PID 828 wrote to memory of 2328 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 35 PID 828 wrote to memory of 2328 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 35 PID 828 wrote to memory of 2328 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 35 PID 828 wrote to memory of 2328 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 35 PID 828 wrote to memory of 2164 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 37 PID 828 wrote to memory of 2164 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 37 PID 828 wrote to memory of 2164 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 37 PID 828 wrote to memory of 2164 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 37 PID 828 wrote to memory of 2228 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 39 PID 828 wrote to memory of 2228 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 39 PID 828 wrote to memory of 2228 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 39 PID 828 wrote to memory of 2228 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 39 PID 828 wrote to memory of 2728 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 41 PID 828 wrote to memory of 2728 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 41 PID 828 wrote to memory of 2728 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 41 PID 828 wrote to memory of 2728 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 41 PID 828 wrote to memory of 2848 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 43 PID 828 wrote to memory of 2848 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 43 PID 828 wrote to memory of 2848 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 43 PID 828 wrote to memory of 2848 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 43 PID 828 wrote to memory of 2740 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 256 PID 828 wrote to memory of 2740 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 256 PID 828 wrote to memory of 2740 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 256 PID 828 wrote to memory of 2740 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 256 PID 828 wrote to memory of 2432 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 225 PID 828 wrote to memory of 2432 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 225 PID 828 wrote to memory of 2432 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 225 PID 828 wrote to memory of 2432 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 225 PID 828 wrote to memory of 2620 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 251 PID 828 wrote to memory of 2620 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 251 PID 828 wrote to memory of 2620 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 251 PID 828 wrote to memory of 2620 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 251 PID 828 wrote to memory of 2724 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 50 PID 828 wrote to memory of 2724 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 50 PID 828 wrote to memory of 2724 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 50 PID 828 wrote to memory of 2724 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 50 PID 828 wrote to memory of 2604 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 53 PID 828 wrote to memory of 2604 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 53 PID 828 wrote to memory of 2604 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 53 PID 828 wrote to memory of 2604 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 53 PID 828 wrote to memory of 1352 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 55 PID 828 wrote to memory of 1352 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 55 PID 828 wrote to memory of 1352 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 55 PID 828 wrote to memory of 1352 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 55 PID 828 wrote to memory of 320 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 171 PID 828 wrote to memory of 320 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 171 PID 828 wrote to memory of 320 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 171 PID 828 wrote to memory of 320 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 171 PID 828 wrote to memory of 1724 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 183 PID 828 wrote to memory of 1724 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 183 PID 828 wrote to memory of 1724 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 183 PID 828 wrote to memory of 1724 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 183 PID 828 wrote to memory of 1644 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 174 PID 828 wrote to memory of 1644 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 174 PID 828 wrote to memory of 1644 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 174 PID 828 wrote to memory of 1644 828 513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe 174
Processes
-
C:\Users\Admin\AppData\Local\Temp\513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe"C:\Users\Admin\AppData\Local\Temp\513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im mysql*2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:796
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im dsa*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im Ntrtscan*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2328
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im ds_monitor*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2164
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im Notifier*2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2228
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im TmListen*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im iVPAgent*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2848
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im CNTAoSMgr*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im IBM*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2432
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im bes10*2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2620
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im black*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2724
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im robo*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2604
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im copy*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1352
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im store.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:320
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im sql*2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1724
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im vee*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1644
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im wrsa*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1840
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im wrsa.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im postg*2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2192
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im sage*2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2092
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop MSSQLServerADHelper1002⤵
- System Location Discovery: System Language Discovery
PID:2188 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper1003⤵PID:2008
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop MSSQL$ISARS2⤵PID:2936
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$ISARS3⤵
- System Location Discovery: System Language Discovery
PID:3004
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop MSSQL$MSFW2⤵PID:1920
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$MSFW3⤵
- System Location Discovery: System Language Discovery
PID:2080
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop SQLAgent$ISARS2⤵
- System Location Discovery: System Language Discovery
PID:1836 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$ISARS3⤵PID:2396
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop SQLAgent$MSFW2⤵
- System Location Discovery: System Language Discovery
PID:1540 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$MSFW3⤵PID:1888
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop SQLBrowser2⤵
- System Location Discovery: System Language Discovery
PID:1736 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser3⤵PID:2148
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop ReportServer$ISARS2⤵PID:640
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$ISARS3⤵
- System Location Discovery: System Language Discovery
PID:2860
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop SQLWriter2⤵
- System Location Discovery: System Language Discovery
PID:1636 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter3⤵
- System Location Discovery: System Language Discovery
PID:2636
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop WinDefend2⤵PID:1700
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend3⤵
- System Location Discovery: System Language Discovery
PID:2364
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop mr2kserv2⤵
- System Location Discovery: System Language Discovery
PID:2004 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mr2kserv3⤵PID:2632
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop MSExchangeADTopology2⤵PID:980
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeADTopology3⤵PID:2832
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop MSExchangeFBA2⤵
- System Location Discovery: System Language Discovery
PID:1780 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeFBA3⤵PID:2716
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop MSExchangeIS2⤵PID:2880
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeIS3⤵
- System Location Discovery: System Language Discovery
PID:2876
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop MSExchangeSA2⤵PID:2776
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeSA3⤵PID:2904
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop ShadowProtectSvc2⤵
- System Location Discovery: System Language Discovery
PID:2836 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ShadowProtectSvc3⤵
- System Location Discovery: System Language Discovery
PID:2044
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop SPAdminV42⤵
- System Location Discovery: System Language Discovery
PID:2884 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPAdminV43⤵
- System Location Discovery: System Language Discovery
PID:2956
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop SPTimerV42⤵
- System Time Discovery
PID:2208 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPTimerV43⤵
- System Location Discovery: System Language Discovery
- System Time Discovery
PID:2028
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop SPTraceV42⤵PID:2608
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPTraceV43⤵PID:2760
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop SPUserCodeV42⤵
- System Location Discovery: System Language Discovery
PID:2560 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPUserCodeV43⤵PID:2348
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop SPWriterV42⤵
- System Location Discovery: System Language Discovery
PID:1492 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPWriterV43⤵PID:1404
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop SPSearch42⤵
- System Location Discovery: System Language Discovery
PID:824 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPSearch43⤵
- System Location Discovery: System Language Discovery
PID:2424
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop MSSQLServerADHelper1002⤵PID:2660
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper1003⤵
- System Location Discovery: System Language Discovery
PID:2068
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop IISADMIN2⤵PID:2824
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop IISADMIN3⤵PID:3048
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop firebirdguardiandefaultinstance2⤵
- System Location Discovery: System Language Discovery
PID:2624 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop firebirdguardiandefaultinstance3⤵PID:1348
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop ibmiasrw2⤵PID:2692
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ibmiasrw3⤵PID:3004
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QBCFMonitorService2⤵PID:588
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBCFMonitorService3⤵PID:1040
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QBVSS2⤵
- System Location Discovery: System Language Discovery
PID:2844 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBVSS3⤵
- System Location Discovery: System Language Discovery
PID:2080
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QBPOSDBServiceV122⤵
- System Location Discovery: System Language Discovery
PID:2948 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBPOSDBServiceV123⤵
- System Location Discovery: System Language Discovery
PID:1888
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "IBM Domino Server(CProgramFilesIBMDominodata)"2⤵PID:1768
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "IBM Domino Server(CProgramFilesIBMDominodata)"3⤵PID:1640
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "IBM Domino Diagnostics(CProgramFilesIBMDomino)"2⤵
- System Location Discovery: System Language Discovery
PID:1512 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "IBM Domino Diagnostics(CProgramFilesIBMDomino)"3⤵
- System Location Discovery: System Language Discovery
PID:608
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop IISADMIN2⤵PID:2528
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop IISADMIN3⤵
- System Location Discovery: System Language Discovery
PID:320
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "Simply Accounting Database Connection Manager"2⤵
- System Location Discovery: System Language Discovery
PID:2148 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Simply Accounting Database Connection Manager"3⤵PID:1192
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QuickBooksDB12⤵
- System Location Discovery: System Language Discovery
PID:884 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB13⤵
- System Location Discovery: System Language Discovery
PID:1588
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QuickBooksDB22⤵PID:1204
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB23⤵PID:1596
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QuickBooksDB32⤵
- System Location Discovery: System Language Discovery
PID:2932 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB33⤵
- System Location Discovery: System Language Discovery
PID:2916
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QuickBooksDB42⤵
- System Location Discovery: System Language Discovery
PID:1928 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB43⤵PID:2508
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QuickBooksDB52⤵PID:792
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB53⤵
- System Location Discovery: System Language Discovery
PID:484
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QuickBooksDB62⤵
- System Location Discovery: System Language Discovery
PID:1960 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB63⤵PID:616
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QuickBooksDB72⤵
- System Location Discovery: System Language Discovery
PID:1500 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB73⤵
- System Location Discovery: System Language Discovery
PID:1628
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QuickBooksDB82⤵PID:1724
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB83⤵PID:1700
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QuickBooksDB92⤵PID:1744
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB93⤵
- System Location Discovery: System Language Discovery
PID:2768
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QuickBooksDB102⤵PID:3052
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB103⤵
- System Location Discovery: System Language Discovery
PID:2964
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QuickBooksDB112⤵PID:1740
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB113⤵
- System Location Discovery: System Language Discovery
PID:1648
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QuickBooksDB122⤵
- System Location Discovery: System Language Discovery
PID:1712 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB123⤵PID:1872
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QuickBooksDB132⤵
- System Location Discovery: System Language Discovery
PID:1880 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB133⤵PID:2736
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QuickBooksDB142⤵
- System Location Discovery: System Language Discovery
PID:3036 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB143⤵PID:2172
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QuickBooksDB152⤵PID:2960
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB153⤵PID:1780
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QuickBooksDB162⤵PID:2584
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB163⤵PID:2716
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QuickBooksDB172⤵PID:2248
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB173⤵
- System Location Discovery: System Language Discovery
PID:2520
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QuickBooksDB182⤵PID:640
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB183⤵
- System Location Discovery: System Language Discovery
PID:1108
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QuickBooksDB192⤵
- System Location Discovery: System Language Discovery
PID:2876 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB193⤵
- System Location Discovery: System Language Discovery
PID:2836
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QuickBooksDB202⤵PID:2712
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB203⤵PID:2044
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QuickBooksDB212⤵PID:2432
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB213⤵PID:2368
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QuickBooksDB222⤵PID:2196
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB223⤵PID:2588
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QuickBooksDB232⤵
- System Location Discovery: System Language Discovery
PID:1132 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB233⤵PID:1728
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QuickBooksDB242⤵
- System Location Discovery: System Language Discovery
PID:448 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB243⤵PID:2620
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop QuickBooksDB252⤵PID:2760
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB253⤵PID:2868
-
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /PID "2712"2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1480
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /PID "2712"2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2068
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /PID "2712"2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /PID "2432"2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:824
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /PID "2432"2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2696
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /PID "2432"2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2944
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /PID "2196"2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3004
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /PID "2196"2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:588
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /PID "2196"2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1696
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /PID "1132"2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1876
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /PID "1132"2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3068
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /PID "1132"2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:788
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /PID "2760"2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:972
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /PID "2760"2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1960
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /PID "2760"2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1688
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-920361397-455352954145608291295062029436467011-2083657928-1630133219859086464"1⤵PID:1540
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "986654627-1626514809-888695962-11799503044450980231166288374-1223185277-1066786889"1⤵PID:1736
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1189573867-892120566942384988-38111527618959676111091956562189480072106698280"1⤵PID:1644
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1205979640-1732864898-301322901944405601-13774720391190635593-7799910221120107683"1⤵PID:2804
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-161957301-5480256554841813261178088080-1277238527-865664954-68090980-891309342"1⤵PID:2004
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "368450378-525036244-350061796-201167179-99720042763005170518104128481732540735"1⤵PID:2776
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "8851457492083940483523702463-1920929385-493451444697085792-355570833-1760681848"1⤵PID:2424
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "3955504191830642786-595195050-6302489641762350269-78358277010697247181174836406"1⤵PID:2956
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1820029086-692687778-359123049649262640296350747-11730651561128499137-1889383716"1⤵PID:2740
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "59804450320334554-1798728081-916215206-715834437-416751795982545285-957767028"1⤵PID:616
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1075430327-1402677405143363371-41797668-992576816101319521648350176576583233"1⤵PID:1840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5456f9ee19279b7267f4a39a1d09d23ff
SHA1ff811ade989d29d81537b1549489b55965e78041
SHA25676800f4dd8d468918290faced7b06fa0a287930d4c76e7719d49b41ba43a45c7
SHA5125117b46ced621edb9d2552539613e76982d4d7f45ba2a709d92b6b0eab3f955af596fd5079fdc9326f784804a7c5f81e5d1e7a3bd3373b6fe50235afa87f8f07