b3c6854e6f03c4b3797812b735564a2a2038f1c1f4339875a9d172421048f11a

Analysis

user interaction
yes
max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 09:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cacked by credos.exe
Size 704KB
Sample260831-lkpcqsff77
SHA256 b3c6854e6f03c4b3797812b735564a2a2038f1c1f4339875a9d172421048f11a
MD5 dc1dfe64a9e61378047ad7e54789e811
SHA1 5f0ec82db920ebd7e9d3968ec936bdc717931205
SHA512 1bf47ed33b2b294a2f179fd472ba2feaf8cb2462a88528d774a36db5adf9f09bc4ae6529dd1f6970181ba1b1c4ef34ce77c9780a1b9a53174ba30b12f14bd40d
SSDEEP 12288:qEZfy4RQUDG4Fx0m5X3BsjNdlz0b3wawjE:dfyIQUDG4P0yX3Kjp0bwaz
TLSH
T11FE46D269BA402BCE0A6C179CE979952F775780B03B19EEF07D045A25F1B5E09F3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4520	cmd.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4900	sc.exe
4356	sc.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1588	cmd.exe
2040	cmd.exe
1944	cmd.exe
2776	cmd.exe
4552	cmd.exe
2052	cmd.exe
4528	cmd.exe
3724	cmd.exe
5080	cmd.exe
4224	cmd.exe
3688	cmd.exe
2488	cmd.exe
4452	cmd.exe
1424	cmd.exe
2684	cmd.exe
4028	cmd.exe
5016	cmd.exe
4068	cmd.exe
1216	cmd.exe
2892	cmd.exe
4712	cmd.exe
3292	cmd.exe
2288	cmd.exe
3156	cmd.exe
1032	cmd.exe
1332	cmd.exe
1052	cmd.exe
2272	cmd.exe
1680	cmd.exe
1104	cmd.exe
3904	cmd.exe
2996	cmd.exe
1408	cmd.exe
4480	cmd.exe
2980	cmd.exe
2620	cmd.exe
3980	cmd.exe
936	cmd.exe
4676	cmd.exe
4904	cmd.exe
3300	cmd.exe
3480	cmd.exe
3960	cmd.exe
2792	cmd.exe
4020	cmd.exe
4448	cmd.exe
2536	cmd.exe
3908	cmd.exe
4316	cmd.exe
4348	cmd.exe
1636	cmd.exe
3436	cmd.exe
5040	cmd.exe
1720	cmd.exe
3024	cmd.exe
896	cmd.exe
3364	cmd.exe
3720	cmd.exe
2760	cmd.exe
3080	cmd.exe
1380	cmd.exe
2112	cmd.exe
1208	cmd.exe
4684	cmd.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
680	taskkill.exe
4396	taskkill.exe
224	taskkill.exe
812	taskkill.exe
2992	taskkill.exe
4304	taskkill.exe
1056	taskkill.exe
680	taskkill.exe
2124	taskkill.exe
3720	taskkill.exe
3648	taskkill.exe
3676	taskkill.exe
1748	taskkill.exe
4364	taskkill.exe
1560	taskkill.exe
4796	taskkill.exe
1056	taskkill.exe
4776	taskkill.exe
4280	taskkill.exe
1536	taskkill.exe
2172	taskkill.exe
4396	taskkill.exe
2492	taskkill.exe
5020	taskkill.exe
3584	taskkill.exe
5088	taskkill.exe
2980	taskkill.exe
1236	taskkill.exe
1756	taskkill.exe
2712	taskkill.exe
3980	taskkill.exe
368	taskkill.exe
2468	taskkill.exe
2080	taskkill.exe
3312	taskkill.exe
4632	taskkill.exe
2492	taskkill.exe
4860	taskkill.exe
1720	taskkill.exe
1824	taskkill.exe
3676	taskkill.exe
2424	taskkill.exe
4456	taskkill.exe
3664	taskkill.exe
220	taskkill.exe
2248	taskkill.exe
5088	taskkill.exe
4108	taskkill.exe
4756	taskkill.exe
2584	taskkill.exe
4824	taskkill.exe
4496	taskkill.exe
1760	taskkill.exe
3100	taskkill.exe
4808	taskkill.exe
368	taskkill.exe
2420	taskkill.exe
4572	taskkill.exe
2348	taskkill.exe
3256	taskkill.exe
1556	taskkill.exe
2960	taskkill.exe
1052	taskkill.exe
564	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe
1896	cacked by credos.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1896	cacked by credos.exe
Token: SeDebugPrivilege	3720	taskkill.exe
Token: SeDebugPrivilege	516	taskkill.exe
Token: SeDebugPrivilege	3980	taskkill.exe
Token: SeDebugPrivilege	3800	taskkill.exe
Token: SeDebugPrivilege	2492	taskkill.exe
Token: SeDebugPrivilege	3648	taskkill.exe
Token: SeDebugPrivilege	2572	taskkill.exe
Token: SeDebugPrivilege	2424	taskkill.exe
Token: SeDebugPrivilege	4860	taskkill.exe
Token: SeDebugPrivilege	2792	taskkill.exe
Token: SeDebugPrivilege	1640	taskkill.exe
Token: SeDebugPrivilege	3676	taskkill.exe
Token: SeDebugPrivilege	2448	taskkill.exe
Token: SeDebugPrivilege	564	taskkill.exe
Token: SeDebugPrivilege	4280	taskkill.exe
Token: SeDebugPrivilege	2960	taskkill.exe
Token: SeDebugPrivilege	4808	taskkill.exe
Token: SeDebugPrivilege	2248	taskkill.exe
Token: SeDebugPrivilege	1052	taskkill.exe
Token: SeDebugPrivilege	4804	taskkill.exe
Token: SeDebugPrivilege	368	taskkill.exe
Token: SeDebugPrivilege	5088	taskkill.exe
Token: SeDebugPrivilege	4456	taskkill.exe
Token: SeDebugPrivilege	2932	taskkill.exe
Token: SeDebugPrivilege	2104	taskkill.exe
Token: SeDebugPrivilege	1056	taskkill.exe
Token: SeDebugPrivilege	1720	taskkill.exe
Token: SeDebugPrivilege	1860	taskkill.exe
Token: SeDebugPrivilege	4568	taskkill.exe
Token: SeDebugPrivilege	3648	taskkill.exe
Token: SeDebugPrivilege	2992	taskkill.exe
Token: SeDebugPrivilege	680	taskkill.exe
Token: SeDebugPrivilege	1156	taskkill.exe
Token: SeDebugPrivilege	2980	taskkill.exe
Token: SeDebugPrivilege	3200	taskkill.exe
Token: SeDebugPrivilege	2720	taskkill.exe
Token: SeDebugPrivilege	4796	taskkill.exe
Token: SeDebugPrivilege	1536	taskkill.exe
Token: SeDebugPrivilege	2584	taskkill.exe
Token: SeDebugPrivilege	1236	taskkill.exe
Token: SeDebugPrivilege	408	taskkill.exe
Token: SeDebugPrivilege	880	taskkill.exe
Token: SeDebugPrivilege	4756	taskkill.exe
Token: SeDebugPrivilege	5116	taskkill.exe
Token: SeDebugPrivilege	1380	taskkill.exe
Token: SeDebugPrivilege	3252	taskkill.exe
Token: SeDebugPrivilege	1748	taskkill.exe
Token: SeDebugPrivilege	4420	taskkill.exe
Token: SeDebugPrivilege	2420	taskkill.exe
Token: SeDebugPrivilege	4568	taskkill.exe
Token: SeDebugPrivilege	4304	taskkill.exe
Token: SeDebugPrivilege	4248	taskkill.exe
Token: SeDebugPrivilege	1708	taskkill.exe
Token: SeDebugPrivilege	1824	taskkill.exe
Token: SeDebugPrivilege	3664	taskkill.exe
Token: SeDebugPrivilege	564	taskkill.exe
Token: SeDebugPrivilege	5068	taskkill.exe
Token: SeDebugPrivilege	4508	taskkill.exe
Token: SeDebugPrivilege	3680	taskkill.exe
Token: SeDebugPrivilege	4572	taskkill.exe
Token: SeDebugPrivilege	3076	taskkill.exe
Token: SeDebugPrivilege	4656	taskkill.exe
Token: SeDebugPrivilege	4868	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 1084	1896	cacked by credos.exe	90
PID 1896 wrote to memory of 2384	1896	cacked by credos.exe	101
PID 1896 wrote to memory of 1216	1896	cacked by credos.exe	102
PID 2384 wrote to memory of 3720	2384	cmd.exe	104
PID 1216 wrote to memory of 3168	1216	cmd.exe	105
PID 1896 wrote to memory of 4520	1896	cacked by credos.exe	106
PID 4520 wrote to memory of 3496	4520	cmd.exe	108
PID 1896 wrote to memory of 4448	1896	cacked by credos.exe	109
PID 4448 wrote to memory of 4356	4448	cmd.exe	110
PID 1896 wrote to memory of 3908	1896	cacked by credos.exe	111
PID 3908 wrote to memory of 4900	3908	cmd.exe	112
PID 1896 wrote to memory of 3844	1896	cacked by credos.exe	113
PID 3844 wrote to memory of 516	3844	cmd.exe	114
PID 1896 wrote to memory of 444	1896	cacked by credos.exe	115
PID 444 wrote to memory of 3980	444	cmd.exe	116
PID 1896 wrote to memory of 2112	1896	cacked by credos.exe	117
PID 2112 wrote to memory of 3800	2112	cmd.exe	118
PID 1896 wrote to memory of 4560	1896	cacked by credos.exe	119
PID 4560 wrote to memory of 2492	4560	cmd.exe	120
PID 1896 wrote to memory of 2488	1896	cacked by credos.exe	121
PID 2488 wrote to memory of 3648	2488	cmd.exe	122
PID 1896 wrote to memory of 2040	1896	cacked by credos.exe	123
PID 2040 wrote to memory of 2572	2040	cmd.exe	124
PID 1896 wrote to memory of 3884	1896	cacked by credos.exe	125
PID 3884 wrote to memory of 2424	3884	cmd.exe	126
PID 1896 wrote to memory of 4452	1896	cacked by credos.exe	127
PID 4452 wrote to memory of 4860	4452	cmd.exe	128
PID 1896 wrote to memory of 2272	1896	cacked by credos.exe	129
PID 2272 wrote to memory of 2792	2272	cmd.exe	130
PID 1896 wrote to memory of 2892	1896	cacked by credos.exe	131
PID 2892 wrote to memory of 1640	2892	cmd.exe	132
PID 1896 wrote to memory of 984	1896	cacked by credos.exe	133
PID 984 wrote to memory of 3676	984	cmd.exe	134
PID 1896 wrote to memory of 3012	1896	cacked by credos.exe	135
PID 3012 wrote to memory of 2448	3012	cmd.exe	136
PID 1896 wrote to memory of 3724	1896	cacked by credos.exe	137
PID 3724 wrote to memory of 564	3724	cmd.exe	138
PID 1896 wrote to memory of 4104	1896	cacked by credos.exe	139
PID 4104 wrote to memory of 4280	4104	cmd.exe	140
PID 1896 wrote to memory of 1944	1896	cacked by credos.exe	143
PID 1944 wrote to memory of 2960	1944	cmd.exe	144
PID 1896 wrote to memory of 1408	1896	cacked by credos.exe	145
PID 1408 wrote to memory of 4808	1408	cmd.exe	146
PID 1896 wrote to memory of 3364	1896	cacked by credos.exe	147
PID 3364 wrote to memory of 2248	3364	cmd.exe	148
PID 1896 wrote to memory of 1680	1896	cacked by credos.exe	149
PID 1680 wrote to memory of 1052	1680	cmd.exe	150
PID 1896 wrote to memory of 1104	1896	cacked by credos.exe	152
PID 1104 wrote to memory of 4804	1104	cmd.exe	153
PID 1896 wrote to memory of 3720	1896	cacked by credos.exe	154
PID 3720 wrote to memory of 368	3720	cmd.exe	155
PID 1896 wrote to memory of 2776	1896	cacked by credos.exe	156
PID 2776 wrote to memory of 5088	2776	cmd.exe	157
PID 1896 wrote to memory of 4356	1896	cacked by credos.exe	158
PID 4356 wrote to memory of 4456	4356	cmd.exe	159
PID 1896 wrote to memory of 3048	1896	cacked by credos.exe	160
PID 3048 wrote to memory of 2932	3048	cmd.exe	161
PID 1896 wrote to memory of 2632	1896	cacked by credos.exe	162
PID 2632 wrote to memory of 2104	2632	cmd.exe	163
PID 1896 wrote to memory of 2620	1896	cacked by credos.exe	164
PID 2620 wrote to memory of 1056	2620	cmd.exe	165
PID 1896 wrote to memory of 3980	1896	cacked by credos.exe	166
PID 3980 wrote to memory of 1720	3980	cmd.exe	167
PID 1896 wrote to memory of 3904	1896	cacked by credos.exe	168

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3168	attrib.exe
3496	attrib.exe

C:\Users\Admin\AppData\Local\Temp\cacked by credos.exe
"C:\Users\Admin\AppData\Local\Temp\cacked by credos.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c title CREDOS.
  2⤵
  PID:1084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3720
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib -h -s "C:\Users\Admin\AppData\Local\Temp\server.pfx"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Temp\server.pfx"
    3⤵
    - Views/modifies file attributes
    PID:3168
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Local\Temp\server.pfx"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\server.pfx"
    3⤵
    - Views/modifies file attributes
    PID:3496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\system32\sc.exe
    sc stop vgc
    3⤵
    - Launches sc.exe
    PID:4356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\system32\sc.exe
    sc start vgc
    3⤵
    - Launches sc.exe
    PID:4900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:444
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3904
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:596
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3156
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1032
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4552
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3688
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1208
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4912
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2760
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:936
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3480
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:996
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2168
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4480
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4808
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4260
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4804
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3960
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3436
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4800
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1424
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:5032
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1116
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4676
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1752
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2792
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2980
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:768
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4028
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4424
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4316
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2592
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1952
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4684
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4080
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:5044
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5080
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:4824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1704
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1204
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:4364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3172
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:1380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2876
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:2468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2680
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:1160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1588
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:1056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2748
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:3988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:780
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:2492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2996
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:2080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:776
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:1808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:208
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4712
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:2752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5016
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:2348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1100
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:4496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4144
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:5020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:440
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:4820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2052
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:3612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1780
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2536
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:3244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4348
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:3584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4504
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:2084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1332
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:1656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4572
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:3772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4904
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:3256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4528
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:3312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5040
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:4444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3292
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:1756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3080
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:2576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:832
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:2924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2684
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:4396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2104
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:4108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2364
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:1056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1720
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:1560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:712
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:4332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3024
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:2392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4908
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:1556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3972
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:1708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2288
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:4776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3300
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:3676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4020
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:5028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4068
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:1760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4280
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:2124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:220
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4540
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:4508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2716
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:1664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1636
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:2248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2960
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:3100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1052
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:4632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3852
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:2172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:896
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:2712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1716
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1380
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:5088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2468
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:4396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4224
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:4108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4592
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:3532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

server.pfx

Path C:\Users\Admin\AppData\Local\Temp\server.pfx
Size 85B
SHA256 eb51f27de6948781e55521316388389d2b1e68240041eae99b7bb95c3be9735f
MD5 d75e2e53f374fd6b2a0b29efa6b0ad4e
SHA1 e506685d49491e3ca1a16f2d3ebc62215c3b159d
SHA512 7f3aafddfaf07fd9e376e0827cf26e3fcd2946273a79ec85d1818620d82764b99e382e737a83e6fb2f175c8b4c1d1f3ccf02400729fb9fe5dbaadb25799cd8a7
TLSH
T11CA01221016861B0D96147870098272010B145B409615047FC7002C800A2A812278580
MD5 SHA1 SHA512 TLSH

Submit Download