18-圆4-Se tup.exe, P arentProce ssId: 3828, ProcessC ommandLine : "C:\User s\user\App Data\Local \Temp\is-2 JBFB.tmp\W inMerge-2. tmp, Pare ntCommandL ine: "C:\U sers\user\ Desktop\Wi nMerge-2.1 6.18-圆4-S etup.exe", ParentIm age: C:\Us ers\user\D esktop\Win Merge-2.16. tmp, NewP rocessName : C:\Users \user\AppD ata\Local\ Temp\is-2J BFB.tmp\Wi nMerge-2.1 6.18-圆4-S etup.tmp, OriginalFi leName: C: \Users\use r\AppData\ Local\Temp \is-2JBFB. 16.18-圆4 -Setup.exe ", Comman dLine|base 64offset|c ontains:, Image: C: \Users\use r\AppData\ Local\Temp \is-2JBFB. Sigma detected: Process Start From Suspicious Folder Source: Process st artedĪuthor: frack113: Data: Comm and: "C:\U sers\user\ AppData\Lo cal\Temp\i s-2JBFB.tm p\WinMerge -2.16.18-x 64-Setup.t mp" /SL5=" $30388,778 5947,12134 4,C:\Users \user\Desk top\WinMer ge-2.16.18 -圆4-Setup.
0 kommentar(er)
