Analysis
- max time kernel
151s - max time network
128s - platform
windows7_x64 - resource
win7v20201028 - submitted
11/11/2020, 13:20
Static task
static1
Behavioral task
behavioral1
Sample
INV.NO.213242021.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
INV.NO.213242021.exe
Resource
win10v20201028
0 signatures
0 seconds
General
- Target INV.NO.213242021.exe
- Size 3.8MB
- Sample201111-csdsqyzv7j
- SHA256 7c2f0c42ed478e241d2fdb2580915342c5dbd50acc3fafa26908ae73a581eb3f
- MD5 1dcf7e1f88e88cb6846da1181632ad0e
- SHA1 27e4ee3044b8bc83c52bcd0cb187c4fdafd41605
- SHA512 ae918c428c9e83a562c4a3f5536086b256a4021af2ae14e5f6e69fd327927d7e32510b1ea986961e0c0f3d7d3a21203534de3d61d559dee4f03c6b005f7abc4b
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe, cmd.exe /c start c:\\windows\\wininit.exe" wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe, cmd.exe /c start c:\\windows\\wininit.exe" svchost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe - Executes dropped EXE 4 IoCs
pid Process 2012 INV.NO.213242021.exe 1976 icsys.ico.exe 1344 wininit.exe 1292 svchost.exe - Loads dropped DLL 3 IoCs
pid Process 240 INV.NO.213242021.exe 240 INV.NO.213242021.exe 1976 icsys.ico.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\CsGlckR = "C:\\Users\\Admin\\AppData\\Roaming\\CsGlckR\\CsGlckR.exe" RegSvcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run wininit.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA INV.NO.213242021.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" INV.NO.213242021.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA icsys.ico.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" icsys.ico.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wininit.exe - Modifies service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ASP.NET_4.0.30319\Names\CMyDpxf39VlznYNRBadBhc5ow5HG8d0h7ZQWTnY9Xdo9PVtyGAE3Uh6dIqYcjmBpytpqY0bEfn0JunGnUCjdDcEWWZCsx8bMsHgpmdAy0FR1EEAnz1lTRN = "2012" INV.NO.213242021.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2012 set thread context of 1224 2012 INV.NO.213242021.exe 38 - Drops file in Windows directory 4 IoCs
description ioc Process File created \??\c:\windows\wininit.exe icsys.ico.exe File opened for modification \??\c:\windows\wininit.exe icsys.ico.exe File opened for modification \??\c:\windows\RCX29CE.tmp icsys.ico.exe File opened for modification \??\c:\windows\wininit.exe wininit.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1204 schtasks.exe - Suspicious behavior: EnumeratesProcesses 1852 IoCs
pid Process 1976 icsys.ico.exe 1976 icsys.ico.exe 1344 wininit.exe 1344 wininit.exe 1344 wininit.exe 1344 wininit.exe 1344 wininit.exe 1344 wininit.exe 1344 wininit.exe 1344 wininit.exe 1344 wininit.exe 1344 wininit.exe 1344 wininit.exe 1344 wininit.exe 1344 wininit.exe 1344 wininit.exe 1344 wininit.exe 1344 wininit.exe 1344 wininit.exe 1344 wininit.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 2012 INV.NO.213242021.exe 2012 INV.NO.213242021.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1224 RegSvcs.exe 1292 svchost.exe 1344 wininit.exe 1224 RegSvcs.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe 1344 wininit.exe 1344 wininit.exe 1292 svchost.exe 1292 svchost.exe 1344 wininit.exe 1292 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1344 wininit.exe 1292 svchost.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2012 INV.NO.213242021.exe Token: SeDebugPrivilege 1224 RegSvcs.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1344 wininit.exe - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 240 wrote to memory of 2012 240 INV.NO.213242021.exe 26 PID 240 wrote to memory of 2012 240 INV.NO.213242021.exe 26 PID 240 wrote to memory of 2012 240 INV.NO.213242021.exe 26 PID 240 wrote to memory of 2012 240 INV.NO.213242021.exe 26 PID 240 wrote to memory of 1976 240 INV.NO.213242021.exe 27 PID 240 wrote to memory of 1976 240 INV.NO.213242021.exe 27 PID 240 wrote to memory of 1976 240 INV.NO.213242021.exe 27 PID 240 wrote to memory of 1976 240 INV.NO.213242021.exe 27 PID 1976 wrote to memory of 1344 1976 icsys.ico.exe 28 PID 1976 wrote to memory of 1344 1976 icsys.ico.exe 28 PID 1976 wrote to memory of 1344 1976 icsys.ico.exe 28 PID 1976 wrote to memory of 1344 1976 icsys.ico.exe 28 PID 1976 wrote to memory of 1292 1976 icsys.ico.exe 29 PID 1976 wrote to memory of 1292 1976 icsys.ico.exe 29 PID 1976 wrote to memory of 1292 1976 icsys.ico.exe 29 PID 1976 wrote to memory of 1292 1976 icsys.ico.exe 29 PID 2012 wrote to memory of 1204 2012 INV.NO.213242021.exe 35 PID 2012 wrote to memory of 1204 2012 INV.NO.213242021.exe 35 PID 2012 wrote to memory of 1204 2012 INV.NO.213242021.exe 35 PID 2012 wrote to memory of 1204 2012 INV.NO.213242021.exe 35 PID 2012 wrote to memory of 1760 2012 INV.NO.213242021.exe 37 PID 2012 wrote to memory of 1760 2012 INV.NO.213242021.exe 37 PID 2012 wrote to memory of 1760 2012 INV.NO.213242021.exe 37 PID 2012 wrote to memory of 1760 2012 INV.NO.213242021.exe 37 PID 2012 wrote to memory of 1760 2012 INV.NO.213242021.exe 37 PID 2012 wrote to memory of 1760 2012 INV.NO.213242021.exe 37 PID 2012 wrote to memory of 1760 2012 INV.NO.213242021.exe 37 PID 2012 wrote to memory of 1224 2012 INV.NO.213242021.exe 38 PID 2012 wrote to memory of 1224 2012 INV.NO.213242021.exe 38 PID 2012 wrote to memory of 1224 2012 INV.NO.213242021.exe 38 PID 2012 wrote to memory of 1224 2012 INV.NO.213242021.exe 38 PID 2012 wrote to memory of 1224 2012 INV.NO.213242021.exe 38 PID 2012 wrote to memory of 1224 2012 INV.NO.213242021.exe 38 PID 2012 wrote to memory of 1224 2012 INV.NO.213242021.exe 38 PID 2012 wrote to memory of 1224 2012 INV.NO.213242021.exe 38 PID 2012 wrote to memory of 1224 2012 INV.NO.213242021.exe 38 PID 2012 wrote to memory of 1224 2012 INV.NO.213242021.exe 38 PID 2012 wrote to memory of 1224 2012 INV.NO.213242021.exe 38 PID 2012 wrote to memory of 1224 2012 INV.NO.213242021.exe 38 - System policy modification 1 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" icsys.ico.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" icsys.ico.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" INV.NO.213242021.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" INV.NO.213242021.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" INV.NO.213242021.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" icsys.ico.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\INV.NO.213242021.exe"C:\Users\Admin\AppData\Local\Temp\INV.NO.213242021.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:240 -
C:\Users\Admin\AppData\Local\Temp\INV.NO.213242021.exeC:\Users\Admin\AppData\Local\Temp\INV.NO.213242021.exe2⤵
- Executes dropped EXE
- Modifies service
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DvFYnHppmYOk" /XML "C:\Users\Admin\AppData\Local\Temp\tmpED7A.tmp"3⤵
- Creates scheduled task(s)
PID:1204
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵PID:1760
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1224
-
-
-
C:\Users\Admin\AppData\Local\Temp\icsys.ico.exeC:\Users\Admin\AppData\Local\Temp\icsys.ico.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1976 -
\??\c:\windows\wininit.exec:\windows\wininit.exe3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1344
-
-
\??\c:\users\admin\appdata\local\svchost.exec:\users\admin\appdata\local\svchost.exe3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- System policy modification
PID:1292
-
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
1Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Winlogon Helper DLL
1