Edit tour

Windows Analysis Report
2Nxwe78suT.exe

Overview

General Information

Sample name:	2Nxwe78suT.exe renamed because original name is a hash value
Original sample name:	e26db13a9660555448acb7591f382b480b0252d19e3ad6c6678ba5e1f03d6458.exe
Analysis ID:	1526560
MD5:	626fab8275d8d8e841bc9a08b208201e
SHA1:	197d5c9c5cbf53ed3e78d53a008b6ad665fa3e4c
SHA256:	e26db13a9660555448acb7591f382b480b0252d19e3ad6c6678ba5e1f03d6458
Tags:	DoubleFaceTeamexeuser-JAMESWT_MHT
Infos:

Detection

Score:	42
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Excessive usage of taskkill to terminate processes

Checks for available system drives (often done to infect USB drives)

Creates a process in suspended mode (likely to inject code)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Sleep loop found (likely to delay execution)

Too many similar processes found

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

2Nxwe78suT.exe (PID: 5836 cmdline: "C:\Users\user\Desktop\2Nxwe78suT.exe" MD5: 626FAB8275D8D8E841BC9A08B208201E)

conhost.exe (PID: 4448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5688 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 1532 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 7120 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 6976 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 3872 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 6404 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 3176 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 5532 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 5636 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 5260 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 2132 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 6768 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 5560 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 1476 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 5688 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 3424 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 6596 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 6548 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 7064 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 3292 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 744 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 3116 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 5260 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 5636 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 1276 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 2132 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 4768 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 3424 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 2752 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 5532 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 3116 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 744 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 3652 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 3680 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 6472 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 5768 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 2200 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 6020 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 7156 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 5632 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 5240 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 1576 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 3996 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 5456 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 3528 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 2300 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 2968 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 1644 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 3652 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 5248 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 6472 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 5276 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 4072 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 4476 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 6976 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 1524 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 7064 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 5380 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 5456 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 3996 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 2284 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 3680 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 3176 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 1276 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 3652 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 4292 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 4396 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 4512 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 5776 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 6164 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 6348 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 4424 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 3504 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

taskkill.exe (PID: 3596 cmdline: taskkill /f /im mmc.exe /t MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 3560 cmdline: cmd.exe /c taskkill /f /im mmc.exe /t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 2Nxwe78suT.exe	ReversingLabs: Detection: 63%
Source: 2Nxwe78suT.exe	Virustotal: Detection: 68%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: 2Nxwe78suT.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\2Nxwe78suT.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	File opened: e:	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	File opened: a:	Jump to behavior

Source: unknown

DNS traffic detected: query: 206.23.85.13.in-addr.arpa replaycode: Name error (3)

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

Source: 2Nxwe78suT.exe	String found in binary or memory: https://t.me/Britannique)
Source: 2Nxwe78suT.exe	String found in binary or memory: https://t.me/WalterBishop42)
Source: 2Nxwe78suT.exe	String found in binary or memory: https://t.me/doubleface_group
Source: 2Nxwe78suT.exe	String found in binary or memory: https://t.me/madoneputain)
Source: 2Nxwe78suT.exe	String found in binary or memory: https://t.me/masturbateur)
Source: 2Nxwe78suT.exe	String found in binary or memory: https://t.me/moonnight_god)
Source: 2Nxwe78suT.exe	String found in binary or memory: https://t.me/shiro_SATA)
Source: 2Nxwe78suT.exe	String found in binary or memory: https://t.me/tcpsnow)
Source: 2Nxwe78suT.exe	String found in binary or memory: https://t.me/te1egram_usr)
Source: 2Nxwe78suT.exe	String found in binary or memory: https://t.me/tombezyy)
Source: 2Nxwe78suT.exe	String found in binary or memory: https://t.me/xpolarized)

Source: cmd.exe

Process created: 75

Source: 2Nxwe78suT.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal42.evad.winEXE@361/2@1/0

Source: C:\Users\user\Desktop\2Nxwe78suT.exe

File created: C:\Users\user\AppData\Roaming\time.dat

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4448:120:WilError_03

Source: C:\Users\user\Desktop\2Nxwe78suT.exe

File created: C:\Users\user\AppData\Local\Temp\tmp.bmp

Jump to behavior

Source: 2Nxwe78suT.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\2Nxwe78suT.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2Nxwe78suT.exe	ReversingLabs: Detection: 63%
Source: 2Nxwe78suT.exe	Virustotal: Detection: 68%

Source: unknown	Process created: C:\Users\user\Desktop\2Nxwe78suT.exe "C:\Users\user\Desktop\2Nxwe78suT.exe"
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll

Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Automated click: OK
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Automated click: OK
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Automated click: OK
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Automated click: OK
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Automated click: OK
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Automated click: OK
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 2Nxwe78suT.exe

Static file information: File size 6663168 > 1048576

Source: 2Nxwe78suT.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x631000

Source: 2Nxwe78suT.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Window / User API: threadDelayed 391	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Window / User API: threadDelayed 1144	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Window / User API: threadDelayed 392	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 962	Jump to behavior

Source: C:\Users\user\Desktop\2Nxwe78suT.exe TID: 6416

Thread sleep time: -98000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\2Nxwe78suT.exe

Thread sleep count: Count: 1144 delay: -10

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Excessive usage of taskkill to terminate processes

Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Users\user\Desktop\2Nxwe78suT.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im mmc.exe /t

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 Virtualization/Sandbox Evasion	Remote Services	Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	LSASS Memory	1 Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Virtualization/Sandbox Evasion	Security Account Manager	11 Peripheral Device Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
2Nxwe78suT.exe	63%	ReversingLabs	Win32.Ransomware.Doubleface
2Nxwe78suT.exe	68%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
206.23.85.13.in-addr.arpa	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://t.me/doubleface_group	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
206.23.85.13.in-addr.arpa	unknown	unknown	false	1%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://t.me/shiro_SATA)	2Nxwe78suT.exe	false		unknown
https://t.me/WalterBishop42)	2Nxwe78suT.exe	false		unknown
https://t.me/madoneputain)	2Nxwe78suT.exe	false		unknown
https://t.me/moonnight_god)	2Nxwe78suT.exe	false		unknown
https://t.me/Britannique)	2Nxwe78suT.exe	false		unknown
https://t.me/te1egram_usr)	2Nxwe78suT.exe	false		unknown
https://t.me/doubleface_group	2Nxwe78suT.exe	false	0%, Virustotal, Browse	unknown
https://t.me/masturbateur)	2Nxwe78suT.exe	false		unknown
https://t.me/tcpsnow)	2Nxwe78suT.exe	false		unknown
https://t.me/tombezyy)	2Nxwe78suT.exe	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1526560
Start date and time:	2024-10-06 10:08:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	79
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	2Nxwe78suT.exe renamed because original name is a hash value
Original Sample Name:	e26db13a9660555448acb7591f382b480b0252d19e3ad6c6678ba5e1f03d6458.exe
Detection:	MAL
Classification:	mal42.evad.winEXE@361/2@1/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Connection to analysis system has been lost, crash info: Unknown
Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:09:33	API Interceptor	222x Sleep call for process: 2Nxwe78suT.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\tmp.bmp

Download File

Process:	C:\Users\user\Desktop\2Nxwe78suT.exe
File Type:	PC bitmap, Windows 3.x format, 1920 x 1080 x 24, image size 6220800, cbSize 6220854, bits offset 54
Category:	dropped
Size (bytes):	6220854
Entropy (8bit):	0.023659002560192918
Encrypted:	false
SSDEEP:	768:1MJWWWWW19999999999999TsDFo99999999999990:1MJWWWWWUDFt
MD5:	C09F3B2A45D2AFAF362AB1B4B488EC29
SHA1:	C20661F43F785B8AEAB34BFE01D89774CC04B1F9
SHA-256:	154D1781B19070885989F92C1F77086E2E06DB413EA95E1884BE39570B80343C
SHA-512:	052F198462CFBDDBA68CAEC31AC7A4372AFD8808E97A4D22D6C8C9D80B80E14CAAB43E81307036842B80CCBB16B3B8881164BC0F4D9FEC5A5442CBC832E94383
Malicious:	false
Preview:	BM6.^.....6...(.......8.............^...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\time.dat

Download File

Process:	C:\Users\user\Desktop\2Nxwe78suT.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:LW:i
MD5:	7D98BE1C09B996520B55639DBB338345
SHA1:	490E84D62598EAC54B03233BF6C102866729566F
SHA-256:	FA02750BF6F9EB536FBBEADE8FE7BBC22648F59DABE562A4E32B8A58C4D3D1FF
SHA-512:	B4CEB88DAA004100C2AA0A431B407DAD334233623668D7D766EE352C34EC2EAB86524458CD7BCAC1835FB1FBAC73B15CD9471CB4612EA7BE5C023E241BF7A9FD
Malicious:	false
Preview:	17933

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	0.7157675044601124
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	2Nxwe78suT.exe
File size:	6'663'168 bytes
MD5:	626fab8275d8d8e841bc9a08b208201e
SHA1:	197d5c9c5cbf53ed3e78d53a008b6ad665fa3e4c
SHA256:	e26db13a9660555448acb7591f382b480b0252d19e3ad6c6678ba5e1f03d6458
SHA512:	e106cf78731d9a8e75b5e76ecf881bb12262f13b05b805e89f3bede061a4a1ebb738d7a7631fb51801d95717ca34dabb12f7ed4826e6812ceadb0bad98fcb0d0
SSDEEP:	6144:o3j7hJkMepmEfZsVOM7pNbDMuoKJ+QtDeQYizHMTlaw81FRx3JmfBcOmg:o3nkMS2R6RdQtzH8lhwFbZgaOm
TLSH:	9266C44162E07B61D16B5135CECCA6FC5C9B2C901E73FDDB29893A394AF8390E738919
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................?...........................]r......]r......]r......mq......mqq.....mq......Rich...................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x401367
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x66B0FAC2 [Mon Aug 5 16:16:02 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	51ff6eea1c2dfc853310904ce154f487

Entrypoint Preview

Instruction
call 00007F940CDBED6Dh
jmp 00007F940CDBE909h
jmp 00007F940CDC8B91h
push ebp
mov ebp, esp
jmp 00007F940CDBEA9Fh
push dword ptr [ebp+08h]
call 00007F940CDCA6B6h
pop ecx
test eax, eax
je 00007F940CDBEAA1h
push dword ptr [ebp+08h]
call 00007F940CDC8B61h
pop ecx
test eax, eax
je 00007F940CDBEA78h
pop ebp
ret
cmp dword ptr [ebp+08h], FFFFFFFFh
je 00007F940CDBF157h
jmp 00007F940CDBF134h
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F940CDBEAABh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F940CDBEA9Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F940CDBEA9Eh
add edx, 28h
cmp edx, esi
jne 00007F940CDBEA7Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F940CDBEA8Bh
push esi
call 00007F940CDBF305h
test eax, eax
je 00007F940CDBEAB2h
mov eax, dword ptr fs:[00000018h]
mov esi, 0042AB84h
mov edx, dword ptr [eax+04h]
jmp 00007F940CDBEA96h
cmp edx, eax
je 00007F940CDBEAA2h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F940CDBEA82h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F940CDBEA99h
mov byte ptr [0042AB88h], 00000001h
call 00007F940CDBF0F0h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2810c	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x30000	0x630e40	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x27160	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x270a0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x21000	0x22c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1fcdc	0x1fe00	91e8d114dde2a1fa5dd992232fd413d8	False	0.5609145220588235	COM executable for DOS	6.641181465762842	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x21000	0x7cf8	0x7e00	2822e17149dba8b6e68d2a2ab8fa88a6	False	0.470734126984127	data	5.1988050149092455	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x29000	0x609c	0x1c00	b961ca0002e8b48cbc78a78d693121bb	False	0.4478236607142857	DOS executable (block device driver)	4.5779258901269095	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x30000	0x630e40	0x631000	66aa824f35f1f113de18d93d3d9c75e3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x30338	0x2	data	English	United States	5.0
RT_BITMAP	0x30340	0x5eec28	Device independent bitmap graphic, 1920 x 1080 x 24, image size 6220800	English	United States	0.001010894775390625
RT_BITMAP	0x61ef68	0x41ed8	Device independent bitmap graphic, 300 x 300 x 24, image size 270000	English	United States	0.3934972596652348
RT_DIALOG	0x30140	0x1f4	data	English	United States	0.58

Imports

DLL	Import
USER32.dll	EndPaint, GetWindowLongW, PostMessageW, SetWindowPos, FillRect, GetSystemMetrics, ShowWindow, OpenClipboard, GetDlgItemTextA, SetTimer, DrawTextA, CloseClipboard, EmptyClipboard, MessageBoxA, LoadBitmapW, SetLayeredWindowAttributes, SetClipboardData, wsprintfW, SetWindowLongW, GetClientRect, GetDlgItem, SetRect, KillTimer, SystemParametersInfoW, DialogBoxParamW, FindWindowA, LoadImageW, InvalidateRect, BeginPaint, MessageBoxW
GDI32.dll	BitBlt, CreateCompatibleBitmap, CreateFontA, SelectObject, CreateCompatibleDC, StretchBlt, GetStockObject, DeleteDC, SetTextColor, TextOutA, SetBkMode, GetObjectW, DeleteObject, CreateSolidBrush
SHELL32.dll	SHGetFolderPathA
KERNEL32.dll	FindFirstFileExW, GetFileSizeEx, WideCharToMultiByte, MultiByteToWideChar, IsValidCodePage, LCMapStringW, CompareStringW, HeapFree, HeapAlloc, GetACP, GetOEMCP, GetCPInfo, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, GetStringTypeW, GetProcessHeap, FlushFileBuffers, WriteConsoleW, HeapSize, HeapReAlloc, GetCurrentProcessId, SetStdHandle, GetCommandLineW, GetFileAttributesW, DeleteFileW, SizeofResource, FindFirstFileW, FindNextFileW, WriteFile, WaitForMultipleObjects, GetTempPathW, FindClose, CreateFileW, GetSystemDirectoryW, FreeResource, Sleep, LockResource, GlobalAlloc, CloseHandle, CreateThread, LoadResource, FindResourceW, GlobalLock, GetModuleHandleW, GetConsoleWindow, WinExec, GlobalUnlock, GetDriveTypeW, QueryPerformanceCounter, DecodePointer, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetCurrentProcess, TerminateProcess, GetCommandLineA, RaiseException, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, EncodePointer, SetEndOfFile, SetFilePointerEx, ReadFile, GetConsoleMode, ReadConsoleW, GetFileType, GetConsoleOutputCP, ExitProcess, GetModuleHandleExW, QueryPerformanceFrequency, GetStdHandle, GetModuleFileNameW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 6, 2024 10:09:30.390465975 CEST	53	51582	162.159.36.2	192.168.2.5
Oct 6, 2024 10:09:30.853179932 CEST	56238	53	192.168.2.5	1.1.1.1
Oct 6, 2024 10:09:30.862533092 CEST	53	56238	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 6, 2024 10:09:30.853179932 CEST	192.168.2.5	1.1.1.1	0x8d09	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 6, 2024 10:09:30.862533092 CEST	1.1.1.1	192.168.2.5	0x8d09	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: 2Nxwe78suT.exePID: 5836, Parent PID: 1028

General

Target ID:	0
Start time:	04:08:59
Start date:	06/10/2024
Path:	C:\Users\user\Desktop\2Nxwe78suT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2Nxwe78suT.exe"
Imagebase:	0x400000
File size:	6'663'168 bytes
MD5 hash:	626FAB8275D8D8E841BC9A08B208201E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4448, Parent PID: 5836

General

Target ID:	1
Start time:	04:08:59
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5688, Parent PID: 5836

General

Target ID:	3
Start time:	04:09:00
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 1532, Parent PID: 5688

General

Target ID:	4
Start time:	04:09:00
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 7120, Parent PID: 5836

General

Target ID:	5
Start time:	04:09:01
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: taskkill.exePID: 6976, Parent PID: 7120

General

Target ID:	6
Start time:	04:09:01
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 3872, Parent PID: 5836

General

Target ID:	7
Start time:	04:09:02
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: taskkill.exePID: 6404, Parent PID: 3872

General

Target ID:	8
Start time:	04:09:02
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 3176, Parent PID: 5836

General

Target ID:	9
Start time:	04:09:03
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: taskkill.exePID: 5532, Parent PID: 3176

General

Target ID:	10
Start time:	04:09:03
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5636, Parent PID: 5836

General

Target ID:	11
Start time:	04:09:04
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: taskkill.exePID: 5260, Parent PID: 5636

General

Target ID:	12
Start time:	04:09:04
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 2132, Parent PID: 5836

General

Target ID:	13
Start time:	04:09:05
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 6768, Parent PID: 2132

General

Target ID:	14
Start time:	04:09:05
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5560, Parent PID: 5836

General

Target ID:	15
Start time:	04:09:06
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 1476, Parent PID: 5560

General

Target ID:	16
Start time:	04:09:06
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5688, Parent PID: 5836

General

Target ID:	17
Start time:	04:09:07
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 3424, Parent PID: 5688

General

Target ID:	18
Start time:	04:09:07
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 6596, Parent PID: 5836

General

Target ID:	19
Start time:	04:09:08
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 6548, Parent PID: 6596

General

Target ID:	20
Start time:	04:09:08
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 7064, Parent PID: 5836

General

Target ID:	21
Start time:	04:09:09
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 3292, Parent PID: 7064

General

Target ID:	22
Start time:	04:09:09
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 744, Parent PID: 5836

General

Target ID:	23
Start time:	04:09:10
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x7ff6d64d0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 3116, Parent PID: 744

General

Target ID:	24
Start time:	04:09:10
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5260, Parent PID: 5836

General

Target ID:	25
Start time:	04:09:11
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 5636, Parent PID: 5260

General

Target ID:	26
Start time:	04:09:11
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 1276, Parent PID: 5836

General

Target ID:	28
Start time:	04:09:12
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 2132, Parent PID: 1276

General

Target ID:	29
Start time:	04:09:12
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 4768, Parent PID: 5836

General

Target ID:	30
Start time:	04:09:13
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 3424, Parent PID: 4768

General

Target ID:	31
Start time:	04:09:13
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 2752, Parent PID: 5836

General

Target ID:	32
Start time:	04:09:14
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 5532, Parent PID: 2752

General

Target ID:	33
Start time:	04:09:14
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 3116, Parent PID: 5836

General

Target ID:	34
Start time:	04:09:15
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 744, Parent PID: 3116

General

Target ID:	35
Start time:	04:09:15
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 3652, Parent PID: 5836

General

Target ID:	36
Start time:	04:09:16
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 3680, Parent PID: 3652

General

Target ID:	37
Start time:	04:09:16
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 6472, Parent PID: 5836

General

Target ID:	38
Start time:	04:09:17
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 5768, Parent PID: 6472

General

Target ID:	39
Start time:	04:09:17
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 2200, Parent PID: 5836

General

Target ID:	40
Start time:	04:09:18
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 6020, Parent PID: 2200

General

Target ID:	41
Start time:	04:09:18
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 7156, Parent PID: 5836

General

Target ID:	42
Start time:	04:09:19
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 5632, Parent PID: 7156

General

Target ID:	43
Start time:	04:09:19
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5240, Parent PID: 5836

General

Target ID:	44
Start time:	04:09:20
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 1576, Parent PID: 5240

General

Target ID:	45
Start time:	04:09:20
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 3996, Parent PID: 5836

General

Target ID:	46
Start time:	04:09:21
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 5456, Parent PID: 3996

General

Target ID:	47
Start time:	04:09:21
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 3528, Parent PID: 5836

General

Target ID:	48
Start time:	04:09:22
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 2300, Parent PID: 3528

General

Target ID:	49
Start time:	04:09:23
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 2968, Parent PID: 5836

General

Target ID:	50
Start time:	04:09:23
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 1644, Parent PID: 2968

General

Target ID:	51
Start time:	04:09:23
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 3652, Parent PID: 5836

General

Target ID:	52
Start time:	04:09:24
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 5248, Parent PID: 3652

General

Target ID:	53
Start time:	04:09:24
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 6472, Parent PID: 5836

General

Target ID:	54
Start time:	04:09:25
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 5276, Parent PID: 6472

General

Target ID:	55
Start time:	04:09:26
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 4072, Parent PID: 5836

General

Target ID:	56
Start time:	04:09:26
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 4476, Parent PID: 4072

General

Target ID:	57
Start time:	04:09:26
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 6976, Parent PID: 5836

General

Target ID:	58
Start time:	04:09:27
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 1524, Parent PID: 6976

General

Target ID:	59
Start time:	04:09:27
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 7064, Parent PID: 5836

General

Target ID:	60
Start time:	04:09:28
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 5380, Parent PID: 7064

General

Target ID:	61
Start time:	04:09:29
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5456, Parent PID: 5836

General

Target ID:	62
Start time:	04:09:30
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 3996, Parent PID: 5456

General

Target ID:	63
Start time:	04:09:30
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 2284, Parent PID: 5836

General

Target ID:	64
Start time:	04:09:31
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 3680, Parent PID: 2284

General

Target ID:	65
Start time:	04:09:31
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 3176, Parent PID: 5836

General

Target ID:	66
Start time:	04:09:32
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 1276, Parent PID: 3176

General

Target ID:	67
Start time:	04:09:32
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 3652, Parent PID: 5836

General

Target ID:	68
Start time:	04:09:33
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 4292, Parent PID: 3652

General

Target ID:	69
Start time:	04:09:33
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 4396, Parent PID: 5836

General

Target ID:	70
Start time:	04:09:34
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 4512, Parent PID: 4396

General

Target ID:	71
Start time:	04:09:34
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5776, Parent PID: 5836

General

Target ID:	72
Start time:	04:09:35
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 6164, Parent PID: 5776

General

Target ID:	73
Start time:	04:09:35
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 6348, Parent PID: 5836

General

Target ID:	74
Start time:	04:09:35
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 4424, Parent PID: 6348

General

Target ID:	75
Start time:	04:09:35
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 3504, Parent PID: 5836

General

Target ID:	76
Start time:	04:09:36
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 3596, Parent PID: 3504

General

Target ID:	77
Start time:	04:09:37
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im mmc.exe /t
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 3560, Parent PID: 5836

General

Target ID:	78
Start time:	04:09:37
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c taskkill /f /im mmc.exe /t
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2Nxwe78suT.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

DDoS

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\tmp.bmp

C:\Users\user\AppData\Roaming\time.dat

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: 2Nxwe78suT.exePID: 5836, Parent PID: 1028

General

Chronological Activities

Windows Analysis Report
2Nxwe78suT.exe