Analysis
- max time kernel
150s - max time network
149s - platform
windows10_x64 - resource
win10 - submitted
06/07/2020, 07:30
Static task
static1
Behavioral task
behavioral1
Sample
f0caf48005d504dfb402e3ef4b137187e9ffa0d903099222560d7f4a8885358d.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f0caf48005d504dfb402e3ef4b137187e9ffa0d903099222560d7f4a8885358d.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target f0caf48005d504dfb402e3ef4b137187e9ffa0d903099222560d7f4a8885358d.exe
- Size 37KB
- Sample200706-58pdrde2an
- SHA256 f0caf48005d504dfb402e3ef4b137187e9ffa0d903099222560d7f4a8885358d
- MD5 e479b35f754ed7a7c2a4659d02ad955b
- SHA1 161ad375b47b72727d097c28593fd794dfa9e0b3
- SHA512 e8d8bc604b705d182411e9b1d5193bf55fe6425dd6fe1748096cfa0325f9052039d2c7e7cc7d5b759885e7b7c99ad2a133c6c783d3ca85d0a27f216b250a7c67
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3880 svhost.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\700b09e0f8fdde9ce5346b9046e9ad95.exe svhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\700b09e0f8fdde9ce5346b9046e9ad95.exe svhost.exe - Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\svhost.exe f0caf48005d504dfb402e3ef4b137187e9ffa0d903099222560d7f4a8885358d.exe File opened for modification C:\Windows\svhost.exe f0caf48005d504dfb402e3ef4b137187e9ffa0d903099222560d7f4a8885358d.exe File opened for modification C:\Windows\svhost.exe svhost.exe - Modifies Windows Firewall 1 TTPs
- Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\700b09e0f8fdde9ce5346b9046e9ad95 = "\"C:\\Windows\\svhost.exe\" .." svhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\700b09e0f8fdde9ce5346b9046e9ad95 = "\"C:\\Windows\\svhost.exe\" .." svhost.exe - Suspicious behavior: EnumeratesProcesses 1890 IoCs
pid Process 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe 3880 svhost.exe - Executes dropped EXE 1 IoCs
pid Process 3880 svhost.exe - Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 3880 svhost.exe Token: SeDebugPrivilege 3220 taskkill.exe Token: 33 3880 svhost.exe Token: SeIncBasePriorityPrivilege 3880 svhost.exe Token: 33 3880 svhost.exe Token: SeIncBasePriorityPrivilege 3880 svhost.exe Token: 33 3880 svhost.exe Token: SeIncBasePriorityPrivilege 3880 svhost.exe Token: 33 3880 svhost.exe Token: SeIncBasePriorityPrivilege 3880 svhost.exe Token: 33 3880 svhost.exe Token: SeIncBasePriorityPrivilege 3880 svhost.exe Token: 33 3880 svhost.exe Token: SeIncBasePriorityPrivilege 3880 svhost.exe Token: 33 3880 svhost.exe Token: SeIncBasePriorityPrivilege 3880 svhost.exe Token: 33 3880 svhost.exe Token: SeIncBasePriorityPrivilege 3880 svhost.exe Token: 33 3880 svhost.exe Token: SeIncBasePriorityPrivilege 3880 svhost.exe Token: 33 3880 svhost.exe Token: SeIncBasePriorityPrivilege 3880 svhost.exe Token: 33 3880 svhost.exe Token: SeIncBasePriorityPrivilege 3880 svhost.exe Token: 33 3880 svhost.exe Token: SeIncBasePriorityPrivilege 3880 svhost.exe Token: 33 3880 svhost.exe Token: SeIncBasePriorityPrivilege 3880 svhost.exe Token: 33 3880 svhost.exe Token: SeIncBasePriorityPrivilege 3880 svhost.exe Token: 33 3880 svhost.exe Token: SeIncBasePriorityPrivilege 3880 svhost.exe Token: 33 3880 svhost.exe Token: SeIncBasePriorityPrivilege 3880 svhost.exe Token: 33 3880 svhost.exe Token: SeIncBasePriorityPrivilege 3880 svhost.exe - Kills process with taskkill 1 IoCs
pid Process 3220 taskkill.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 772 wrote to memory of 3880 772 f0caf48005d504dfb402e3ef4b137187e9ffa0d903099222560d7f4a8885358d.exe 66 PID 772 wrote to memory of 3880 772 f0caf48005d504dfb402e3ef4b137187e9ffa0d903099222560d7f4a8885358d.exe 66 PID 772 wrote to memory of 3880 772 f0caf48005d504dfb402e3ef4b137187e9ffa0d903099222560d7f4a8885358d.exe 66 PID 3880 wrote to memory of 1392 3880 svhost.exe 67 PID 3880 wrote to memory of 1392 3880 svhost.exe 67 PID 3880 wrote to memory of 1392 3880 svhost.exe 67 PID 3880 wrote to memory of 3220 3880 svhost.exe 69 PID 3880 wrote to memory of 3220 3880 svhost.exe 69 PID 3880 wrote to memory of 3220 3880 svhost.exe 69
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0caf48005d504dfb402e3ef4b137187e9ffa0d903099222560d7f4a8885358d.exe"C:\Users\Admin\AppData\Local\Temp\f0caf48005d504dfb402e3ef4b137187e9ffa0d903099222560d7f4a8885358d.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\svhost.exe"C:\Windows\svhost.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Drops startup file
- Drops file in Windows directory
- Adds Run entry to start application
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\svhost.exe" "svhost.exe" ENABLE3⤵PID:1392
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Exsample.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Kills process with taskkill
PID:3220
-
-