Analysis
-
max time kernel
152s -
max time network
31s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-12-2020 13:29
Behavioral task
behavioral1
Sample
074da61af9ccb589302c910345868ab1.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
074da61af9ccb589302c910345868ab1.exe
-
Size
2.8MB
-
MD5
074da61af9ccb589302c910345868ab1
-
SHA1
d0d650b0a1135c3eec5e6745c3412d1220a5953e
-
SHA256
c8b5a20926236b4cbc09d13d21b2b434e25aeb91e87a045ef103392a3bf57fdc
-
SHA512
a5095f6395fa714e76e5f0c503aef5cacb45e1459403e985ed048986caf4eea9712bd8cebe08c86a1a9880e95818d872f7638eaab0816453935f65afccc9f20b
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x00040000000130ff-14.dat fakeav behavioral1/files/0x00040000000130ff-20.dat fakeav -
Executes dropped EXE 108 IoCs
pid Process 2004 srtsrv32.exe 1992 LSASSMGR.EXE 756 LSASSMGR.EXE 1968 lssmon.exe 556 LSASSMGR.EXE 340 LSASSMGR.EXE 1692 LSASSMGR.EXE 1772 LSASSMGR.EXE 1284 LSASSMGR.EXE 1440 LSASSMGR.EXE 840 srtsrv32.exe 1000 LSASSMGR.EXE 1664 LSASSMGR.EXE 1064 LSASSMGR.EXE 1256 LSASSMGR.EXE 1668 LSASSMGR.EXE 1712 LSASSMGR.EXE 852 LSASSMGR.EXE 1588 LSASSMGR.EXE 1972 LSASSMGR.EXE 2040 LSASSMGR.EXE 1984 LSASSMGR.EXE 2008 LSASSMGR.EXE 324 LSASSMGR.EXE 1632 LSASSMGR.EXE 884 LSASSMGR.EXE 556 LSASSMGR.EXE 1788 LSASSMGR.EXE 1676 LSASSMGR.EXE 340 LSASSMGR.EXE 316 LSASSMGR.EXE 1412 LSASSMGR.EXE 1700 LSASSMGR.EXE 820 LSASSMGR.EXE 1292 LSASSMGR.EXE 1300 LSASSMGR.EXE 1012 LSASSMGR.EXE 1264 LSASSMGR.EXE 428 LSASSMGR.EXE 1440 wmiprvse.exe 1556 LSASSMGR.EXE 968 LSASSMGR.EXE 1488 LSASSMGR.EXE 1824 LSASSMGR.EXE 1608 LSASSMGR.EXE 1584 LSASSMGR.EXE 1064 LSASSMGR.EXE 1952 LSASSMGR.EXE 1596 LSASSMGR.EXE 1988 LSASSMGR.EXE 2040 LSASSMGR.EXE 2004 LSASSMGR.EXE 652 LSASSMGR.EXE 612 LSASSMGR.EXE 668 LSASSMGR.EXE 1872 LSASSMGR.EXE 1632 LSASSMGR.EXE 1496 LSASSMGR.EXE 1616 LSASSMGR.EXE 1792 LSASSMGR.EXE 1788 LSASSMGR.EXE 1328 LSASSMGR.EXE 1520 LSASSMGR.EXE 1692 LSASSMGR.EXE 1736 LSASSMGR.EXE 1324 LSASSMGR.EXE 1312 LSASSMGR.EXE 1612 LSASSMGR.EXE 1764 LSASSMGR.EXE 1284 LSASSMGR.EXE 428 LSASSMGR.EXE 1104 LSASSMGR.EXE 1680 LSASSMGR.EXE 1256 LSASSMGR.EXE 1364 LSASSMGR.EXE 268 LSASSMGR.EXE 1016 LSASSMGR.EXE 1160 LSASSMGR.EXE 360 LSASSMGR.EXE 964 LSASSMGR.EXE 2032 LSASSMGR.EXE 2004 LSASSMGR.EXE 936 LSASSMGR.EXE 1732 LSASSMGR.EXE 2008 LSASSMGR.EXE 1704 LSASSMGR.EXE 912 LSASSMGR.EXE 652 LSASSMGR.EXE 1316 LSASSMGR.EXE 1672 LSASSMGR.EXE 1564 LSASSMGR.EXE 1632 LSASSMGR.EXE 1484 LSASSMGR.EXE 1788 LSASSMGR.EXE 1792 LSASSMGR.EXE 960 LSASSMGR.EXE 1020 LSASSMGR.EXE 812 LSASSMGR.EXE 1620 LSASSMGR.EXE 1700 LSASSMGR.EXE 744 LSASSMGR.EXE 1560 LSASSMGR.EXE 1964 LSASSMGR.EXE 1284 LSASSMGR.EXE 852 LSASSMGR.EXE 1552 LSASSMGR.EXE 1104 LSASSMGR.EXE 2036 LSASSMGR.EXE -
Sets file execution options in registry 2 TTPs
-
Loads dropped DLL 217 IoCs
pid Process 1824 074da61af9ccb589302c910345868ab1.exe 1824 074da61af9ccb589302c910345868ab1.exe 2004 srtsrv32.exe 2004 srtsrv32.exe 1824 074da61af9ccb589302c910345868ab1.exe 1992 LSASSMGR.EXE 1992 LSASSMGR.EXE 756 LSASSMGR.EXE 756 LSASSMGR.EXE 1968 lssmon.exe 1968 lssmon.exe 556 LSASSMGR.EXE 556 LSASSMGR.EXE 340 LSASSMGR.EXE 340 LSASSMGR.EXE 1772 LSASSMGR.EXE 1692 LSASSMGR.EXE 1692 LSASSMGR.EXE 1772 LSASSMGR.EXE 1968 lssmon.exe 1968 lssmon.exe 1284 LSASSMGR.EXE 1284 LSASSMGR.EXE 840 srtsrv32.exe 840 srtsrv32.exe 1440 LSASSMGR.EXE 1440 LSASSMGR.EXE 1000 LSASSMGR.EXE 1968 lssmon.exe 1000 LSASSMGR.EXE 1968 lssmon.exe 1664 LSASSMGR.EXE 1064 LSASSMGR.EXE 1064 LSASSMGR.EXE 1664 LSASSMGR.EXE 1668 LSASSMGR.EXE 1668 LSASSMGR.EXE 1256 LSASSMGR.EXE 1256 LSASSMGR.EXE 1712 LSASSMGR.EXE 1712 LSASSMGR.EXE 852 LSASSMGR.EXE 2040 LSASSMGR.EXE 852 LSASSMGR.EXE 1588 LSASSMGR.EXE 2040 LSASSMGR.EXE 1588 LSASSMGR.EXE 1972 LSASSMGR.EXE 1060 WerFault.exe 1060 WerFault.exe 1972 LSASSMGR.EXE 2008 LSASSMGR.EXE 1984 LSASSMGR.EXE 2008 LSASSMGR.EXE 1984 LSASSMGR.EXE 1632 LSASSMGR.EXE 324 LSASSMGR.EXE 324 LSASSMGR.EXE 1632 LSASSMGR.EXE 884 LSASSMGR.EXE 884 LSASSMGR.EXE 556 LSASSMGR.EXE 556 LSASSMGR.EXE 1788 LSASSMGR.EXE 1788 LSASSMGR.EXE 1676 LSASSMGR.EXE 1676 LSASSMGR.EXE 1412 LSASSMGR.EXE 1412 LSASSMGR.EXE 340 LSASSMGR.EXE 340 LSASSMGR.EXE 316 LSASSMGR.EXE 316 LSASSMGR.EXE 820 LSASSMGR.EXE 820 LSASSMGR.EXE 1700 LSASSMGR.EXE 1700 LSASSMGR.EXE 1292 LSASSMGR.EXE 1292 LSASSMGR.EXE 1300 LSASSMGR.EXE 1300 LSASSMGR.EXE 1012 LSASSMGR.EXE 1012 LSASSMGR.EXE 1264 LSASSMGR.EXE 1264 LSASSMGR.EXE 428 LSASSMGR.EXE 428 LSASSMGR.EXE 1440 wmiprvse.exe 1440 wmiprvse.exe 1556 LSASSMGR.EXE 1556 LSASSMGR.EXE 968 LSASSMGR.EXE 968 LSASSMGR.EXE 1608 LSASSMGR.EXE 1488 LSASSMGR.EXE 1608 LSASSMGR.EXE 1824 LSASSMGR.EXE 1824 LSASSMGR.EXE 1488 LSASSMGR.EXE 1584 LSASSMGR.EXE 1584 LSASSMGR.EXE 1064 LSASSMGR.EXE 1064 LSASSMGR.EXE 1952 LSASSMGR.EXE 1952 LSASSMGR.EXE 2004 LSASSMGR.EXE 2004 LSASSMGR.EXE 2040 LSASSMGR.EXE 2040 LSASSMGR.EXE 1988 LSASSMGR.EXE 1596 LSASSMGR.EXE 1988 LSASSMGR.EXE 1596 LSASSMGR.EXE 652 LSASSMGR.EXE 652 LSASSMGR.EXE 668 LSASSMGR.EXE 612 LSASSMGR.EXE 668 LSASSMGR.EXE 612 LSASSMGR.EXE 1632 LSASSMGR.EXE 1872 LSASSMGR.EXE 1872 LSASSMGR.EXE 1632 LSASSMGR.EXE 1496 LSASSMGR.EXE 1616 LSASSMGR.EXE 1496 LSASSMGR.EXE 1616 LSASSMGR.EXE 1328 LSASSMGR.EXE 1328 LSASSMGR.EXE 1788 LSASSMGR.EXE 1792 LSASSMGR.EXE 1788 LSASSMGR.EXE 1792 LSASSMGR.EXE 1520 LSASSMGR.EXE 1520 LSASSMGR.EXE 1736 LSASSMGR.EXE 1736 LSASSMGR.EXE 1692 LSASSMGR.EXE 1324 LSASSMGR.EXE 1692 LSASSMGR.EXE 1324 LSASSMGR.EXE 1312 LSASSMGR.EXE 1312 LSASSMGR.EXE 1612 LSASSMGR.EXE 1612 LSASSMGR.EXE 1284 LSASSMGR.EXE 1764 LSASSMGR.EXE 1284 LSASSMGR.EXE 1764 LSASSMGR.EXE 428 LSASSMGR.EXE 428 LSASSMGR.EXE 1104 LSASSMGR.EXE 1104 LSASSMGR.EXE 1680 LSASSMGR.EXE 1680 LSASSMGR.EXE 1364 LSASSMGR.EXE 1364 LSASSMGR.EXE 1256 LSASSMGR.EXE 1256 LSASSMGR.EXE 1016 LSASSMGR.EXE 268 LSASSMGR.EXE 1016 LSASSMGR.EXE 268 LSASSMGR.EXE 360 LSASSMGR.EXE 360 LSASSMGR.EXE 964 LSASSMGR.EXE 964 LSASSMGR.EXE 1160 LSASSMGR.EXE 1160 LSASSMGR.EXE 2032 LSASSMGR.EXE 2032 LSASSMGR.EXE 2004 LSASSMGR.EXE 2004 LSASSMGR.EXE 1732 LSASSMGR.EXE 1732 LSASSMGR.EXE 936 LSASSMGR.EXE 936 LSASSMGR.EXE 2008 LSASSMGR.EXE 2008 LSASSMGR.EXE 1704 LSASSMGR.EXE 1704 LSASSMGR.EXE 912 LSASSMGR.EXE 912 LSASSMGR.EXE 1316 LSASSMGR.EXE 1316 LSASSMGR.EXE 652 LSASSMGR.EXE 652 LSASSMGR.EXE 1672 LSASSMGR.EXE 1484 LSASSMGR.EXE 1672 LSASSMGR.EXE 1564 LSASSMGR.EXE 1632 LSASSMGR.EXE 1564 LSASSMGR.EXE 1632 LSASSMGR.EXE 1484 LSASSMGR.EXE 1788 LSASSMGR.EXE 1792 LSASSMGR.EXE 1788 LSASSMGR.EXE 1792 LSASSMGR.EXE 960 LSASSMGR.EXE 960 LSASSMGR.EXE 1620 LSASSMGR.EXE 1020 LSASSMGR.EXE 1620 LSASSMGR.EXE 1020 LSASSMGR.EXE 1700 LSASSMGR.EXE 1700 LSASSMGR.EXE 812 LSASSMGR.EXE 812 LSASSMGR.EXE 1560 LSASSMGR.EXE 1560 LSASSMGR.EXE 1284 LSASSMGR.EXE 1964 LSASSMGR.EXE 1284 LSASSMGR.EXE 1964 LSASSMGR.EXE 744 LSASSMGR.EXE 744 LSASSMGR.EXE -
Adds Run key to start application 2 TTPs 100 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" srtsrv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 074da61af9ccb589302c910345868ab1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" srtsrv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\lssmon.exe" 074da61af9ccb589302c910345868ab1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\lssmon.exe" lssmon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" wmiprvse.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run lssmon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE" LSASSMGR.EXE -
Drops file in System32 directory 196 IoCs
description ioc Process File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\lssmon.exe 074da61af9ccb589302c910345868ab1.exe File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\srtsrv32.exe 074da61af9ccb589302c910345868ab1.exe File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe wmiprvse.exe File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe srtsrv32.exe File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE wmiprvse.exe File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\lssmon.exe 074da61af9ccb589302c910345868ab1.exe File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE srtsrv32.exe File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\spool.exe srtsrv32.exe File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE srtsrv32.exe File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe LSASSMGR.EXE File opened for modification C:\Windows\SysWOW64\spool.exe srtsrv32.exe File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE File created C:\Windows\SysWOW64\LSASSMGR.EXE LSASSMGR.EXE -
Drops file in Program Files directory 192 IoCs
description ioc Process File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe srtsrv32.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe wmiprvse.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Internet Explorer\iexplor.exe srtsrv32.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe srtsrv32.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe wmiprvse.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\iexplor.exe LSASSMGR.EXE File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe srtsrv32.exe File created C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe LSASSMGR.EXE -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\divx32.dll 074da61af9ccb589302c910345868ab1.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1060 1968 WerFault.exe 28 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1060 WerFault.exe 1060 WerFault.exe 1060 WerFault.exe 1060 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1060 WerFault.exe -
Suspicious use of WriteProcessMemory 436 IoCs
description pid Process procid_target PID 1824 wrote to memory of 2004 1824 074da61af9ccb589302c910345868ab1.exe 26 PID 1824 wrote to memory of 2004 1824 074da61af9ccb589302c910345868ab1.exe 26 PID 1824 wrote to memory of 2004 1824 074da61af9ccb589302c910345868ab1.exe 26 PID 1824 wrote to memory of 2004 1824 074da61af9ccb589302c910345868ab1.exe 26 PID 2004 wrote to memory of 1992 2004 srtsrv32.exe 27 PID 2004 wrote to memory of 1992 2004 srtsrv32.exe 27 PID 2004 wrote to memory of 1992 2004 srtsrv32.exe 27 PID 2004 wrote to memory of 1992 2004 srtsrv32.exe 27 PID 1824 wrote to memory of 1968 1824 074da61af9ccb589302c910345868ab1.exe 28 PID 1824 wrote to memory of 1968 1824 074da61af9ccb589302c910345868ab1.exe 28 PID 1824 wrote to memory of 1968 1824 074da61af9ccb589302c910345868ab1.exe 28 PID 1824 wrote to memory of 1968 1824 074da61af9ccb589302c910345868ab1.exe 28 PID 1992 wrote to memory of 756 1992 LSASSMGR.EXE 29 PID 1992 wrote to memory of 756 1992 LSASSMGR.EXE 29 PID 1992 wrote to memory of 756 1992 LSASSMGR.EXE 29 PID 1992 wrote to memory of 756 1992 LSASSMGR.EXE 29 PID 756 wrote to memory of 556 756 LSASSMGR.EXE 54 PID 756 wrote to memory of 556 756 LSASSMGR.EXE 54 PID 756 wrote to memory of 556 756 LSASSMGR.EXE 54 PID 756 wrote to memory of 556 756 LSASSMGR.EXE 54 PID 1968 wrote to memory of 340 1968 lssmon.exe 57 PID 1968 wrote to memory of 340 1968 lssmon.exe 57 PID 1968 wrote to memory of 340 1968 lssmon.exe 57 PID 1968 wrote to memory of 340 1968 lssmon.exe 57 PID 556 wrote to memory of 1692 556 LSASSMGR.EXE 90 PID 556 wrote to memory of 1692 556 LSASSMGR.EXE 90 PID 556 wrote to memory of 1692 556 LSASSMGR.EXE 90 PID 556 wrote to memory of 1692 556 LSASSMGR.EXE 90 PID 340 wrote to memory of 1772 340 LSASSMGR.EXE 33 PID 340 wrote to memory of 1772 340 LSASSMGR.EXE 33 PID 340 wrote to memory of 1772 340 LSASSMGR.EXE 33 PID 340 wrote to memory of 1772 340 LSASSMGR.EXE 33 PID 1692 wrote to memory of 1440 1692 LSASSMGR.EXE 187 PID 1692 wrote to memory of 1440 1692 LSASSMGR.EXE 187 PID 1692 wrote to memory of 1440 1692 LSASSMGR.EXE 187 PID 1692 wrote to memory of 1440 1692 LSASSMGR.EXE 187 PID 1772 wrote to memory of 1284 1772 LSASSMGR.EXE 130 PID 1772 wrote to memory of 1284 1772 LSASSMGR.EXE 130 PID 1772 wrote to memory of 1284 1772 LSASSMGR.EXE 130 PID 1772 wrote to memory of 1284 1772 LSASSMGR.EXE 130 PID 1968 wrote to memory of 840 1968 lssmon.exe 36 PID 1968 wrote to memory of 840 1968 lssmon.exe 36 PID 1968 wrote to memory of 840 1968 lssmon.exe 36 PID 1968 wrote to memory of 840 1968 lssmon.exe 36 PID 1284 wrote to memory of 1000 1284 LSASSMGR.EXE 37 PID 1284 wrote to memory of 1000 1284 LSASSMGR.EXE 37 PID 1284 wrote to memory of 1000 1284 LSASSMGR.EXE 37 PID 1284 wrote to memory of 1000 1284 LSASSMGR.EXE 37 PID 840 wrote to memory of 1664 840 srtsrv32.exe 38 PID 840 wrote to memory of 1664 840 srtsrv32.exe 38 PID 840 wrote to memory of 1664 840 srtsrv32.exe 38 PID 840 wrote to memory of 1664 840 srtsrv32.exe 38 PID 1440 wrote to memory of 1064 1440 LSASSMGR.EXE 166 PID 1440 wrote to memory of 1064 1440 LSASSMGR.EXE 166 PID 1440 wrote to memory of 1064 1440 LSASSMGR.EXE 166 PID 1440 wrote to memory of 1064 1440 LSASSMGR.EXE 166 PID 1000 wrote to memory of 1256 1000 LSASSMGR.EXE 196 PID 1000 wrote to memory of 1256 1000 LSASSMGR.EXE 196 PID 1000 wrote to memory of 1256 1000 LSASSMGR.EXE 196 PID 1000 wrote to memory of 1256 1000 LSASSMGR.EXE 196 PID 1968 wrote to memory of 1668 1968 lssmon.exe 190 PID 1968 wrote to memory of 1668 1968 lssmon.exe 190 PID 1968 wrote to memory of 1668 1968 lssmon.exe 190 PID 1968 wrote to memory of 1668 1968 lssmon.exe 190 PID 1064 wrote to memory of 1712 1064 LSASSMGR.EXE 193 PID 1064 wrote to memory of 1712 1064 LSASSMGR.EXE 193 PID 1064 wrote to memory of 1712 1064 LSASSMGR.EXE 193 PID 1064 wrote to memory of 1712 1064 LSASSMGR.EXE 193 PID 1968 wrote to memory of 1060 1968 lssmon.exe 41 PID 1968 wrote to memory of 1060 1968 lssmon.exe 41 PID 1968 wrote to memory of 1060 1968 lssmon.exe 41 PID 1968 wrote to memory of 1060 1968 lssmon.exe 41 PID 1664 wrote to memory of 852 1664 LSASSMGR.EXE 221 PID 1664 wrote to memory of 852 1664 LSASSMGR.EXE 221 PID 1664 wrote to memory of 852 1664 LSASSMGR.EXE 221 PID 1664 wrote to memory of 852 1664 LSASSMGR.EXE 221 PID 1668 wrote to memory of 1588 1668 LSASSMGR.EXE 45 PID 1668 wrote to memory of 1588 1668 LSASSMGR.EXE 45 PID 1668 wrote to memory of 1588 1668 LSASSMGR.EXE 45 PID 1668 wrote to memory of 1588 1668 LSASSMGR.EXE 45 PID 1256 wrote to memory of 2040 1256 LSASSMGR.EXE 202 PID 1256 wrote to memory of 2040 1256 LSASSMGR.EXE 202 PID 1256 wrote to memory of 2040 1256 LSASSMGR.EXE 202 PID 1256 wrote to memory of 2040 1256 LSASSMGR.EXE 202 PID 1712 wrote to memory of 1972 1712 LSASSMGR.EXE 47 PID 1712 wrote to memory of 1972 1712 LSASSMGR.EXE 47 PID 1712 wrote to memory of 1972 1712 LSASSMGR.EXE 47 PID 1712 wrote to memory of 1972 1712 LSASSMGR.EXE 47 PID 2040 wrote to memory of 2008 2040 LSASSMGR.EXE 204 PID 2040 wrote to memory of 2008 2040 LSASSMGR.EXE 204 PID 2040 wrote to memory of 2008 2040 LSASSMGR.EXE 204 PID 2040 wrote to memory of 2008 2040 LSASSMGR.EXE 204 PID 1588 wrote to memory of 1824 1588 LSASSMGR.EXE 160 PID 1588 wrote to memory of 1824 1588 LSASSMGR.EXE 160 PID 1588 wrote to memory of 1824 1588 LSASSMGR.EXE 160 PID 1588 wrote to memory of 1824 1588 LSASSMGR.EXE 160 PID 852 wrote to memory of 1984 852 LSASSMGR.EXE 138 PID 852 wrote to memory of 1984 852 LSASSMGR.EXE 138 PID 852 wrote to memory of 1984 852 LSASSMGR.EXE 138 PID 852 wrote to memory of 1984 852 LSASSMGR.EXE 138 PID 1972 wrote to memory of 324 1972 LSASSMGR.EXE 49 PID 1972 wrote to memory of 324 1972 LSASSMGR.EXE 49 PID 1972 wrote to memory of 324 1972 LSASSMGR.EXE 49 PID 1972 wrote to memory of 324 1972 LSASSMGR.EXE 49 PID 2008 wrote to memory of 884 2008 LSASSMGR.EXE 144 PID 2008 wrote to memory of 884 2008 LSASSMGR.EXE 144 PID 2008 wrote to memory of 884 2008 LSASSMGR.EXE 144 PID 2008 wrote to memory of 884 2008 LSASSMGR.EXE 144 PID 1984 wrote to memory of 1632 1984 LSASSMGR.EXE 210 PID 1984 wrote to memory of 1632 1984 LSASSMGR.EXE 210 PID 1984 wrote to memory of 1632 1984 LSASSMGR.EXE 210 PID 1984 wrote to memory of 1632 1984 LSASSMGR.EXE 210 PID 324 wrote to memory of 556 324 LSASSMGR.EXE 54 PID 324 wrote to memory of 556 324 LSASSMGR.EXE 54 PID 324 wrote to memory of 556 324 LSASSMGR.EXE 54 PID 324 wrote to memory of 556 324 LSASSMGR.EXE 54 PID 1632 wrote to memory of 1788 1632 LSASSMGR.EXE 123 PID 1632 wrote to memory of 1788 1632 LSASSMGR.EXE 123 PID 1632 wrote to memory of 1788 1632 LSASSMGR.EXE 123 PID 1632 wrote to memory of 1788 1632 LSASSMGR.EXE 123 PID 884 wrote to memory of 1676 884 LSASSMGR.EXE 188 PID 884 wrote to memory of 1676 884 LSASSMGR.EXE 188 PID 884 wrote to memory of 1676 884 LSASSMGR.EXE 188 PID 884 wrote to memory of 1676 884 LSASSMGR.EXE 188 PID 556 wrote to memory of 340 556 LSASSMGR.EXE 156 PID 556 wrote to memory of 340 556 LSASSMGR.EXE 156 PID 556 wrote to memory of 340 556 LSASSMGR.EXE 156 PID 556 wrote to memory of 340 556 LSASSMGR.EXE 156 PID 1788 wrote to memory of 1412 1788 LSASSMGR.EXE 58 PID 1788 wrote to memory of 1412 1788 LSASSMGR.EXE 58 PID 1788 wrote to memory of 1412 1788 LSASSMGR.EXE 58 PID 1788 wrote to memory of 1412 1788 LSASSMGR.EXE 58 PID 1676 wrote to memory of 316 1676 LSASSMGR.EXE 253 PID 1676 wrote to memory of 316 1676 LSASSMGR.EXE 253 PID 1676 wrote to memory of 316 1676 LSASSMGR.EXE 253 PID 1676 wrote to memory of 316 1676 LSASSMGR.EXE 253 PID 1412 wrote to memory of 1700 1412 LSASSMGR.EXE 159 PID 1412 wrote to memory of 1700 1412 LSASSMGR.EXE 159 PID 1412 wrote to memory of 1700 1412 LSASSMGR.EXE 159 PID 1412 wrote to memory of 1700 1412 LSASSMGR.EXE 159 PID 340 wrote to memory of 1292 340 LSASSMGR.EXE 69 PID 340 wrote to memory of 1292 340 LSASSMGR.EXE 69 PID 340 wrote to memory of 1292 340 LSASSMGR.EXE 69 PID 340 wrote to memory of 1292 340 LSASSMGR.EXE 69 PID 316 wrote to memory of 820 316 LSASSMGR.EXE 154 PID 316 wrote to memory of 820 316 LSASSMGR.EXE 154 PID 316 wrote to memory of 820 316 LSASSMGR.EXE 154 PID 316 wrote to memory of 820 316 LSASSMGR.EXE 154 PID 820 wrote to memory of 1012 820 LSASSMGR.EXE 232 PID 820 wrote to memory of 1012 820 LSASSMGR.EXE 232 PID 820 wrote to memory of 1012 820 LSASSMGR.EXE 232 PID 820 wrote to memory of 1012 820 LSASSMGR.EXE 232 PID 1700 wrote to memory of 1300 1700 LSASSMGR.EXE 176 PID 1700 wrote to memory of 1300 1700 LSASSMGR.EXE 176 PID 1700 wrote to memory of 1300 1700 LSASSMGR.EXE 176 PID 1700 wrote to memory of 1300 1700 LSASSMGR.EXE 176 PID 1292 wrote to memory of 1264 1292 LSASSMGR.EXE 242 PID 1292 wrote to memory of 1264 1292 LSASSMGR.EXE 242 PID 1292 wrote to memory of 1264 1292 LSASSMGR.EXE 242 PID 1292 wrote to memory of 1264 1292 LSASSMGR.EXE 242 PID 1300 wrote to memory of 428 1300 LSASSMGR.EXE 98 PID 1300 wrote to memory of 428 1300 LSASSMGR.EXE 98 PID 1300 wrote to memory of 428 1300 LSASSMGR.EXE 98 PID 1300 wrote to memory of 428 1300 LSASSMGR.EXE 98 PID 1012 wrote to memory of 1440 1012 LSASSMGR.EXE 245 PID 1012 wrote to memory of 1440 1012 LSASSMGR.EXE 245 PID 1012 wrote to memory of 1440 1012 LSASSMGR.EXE 245 PID 1012 wrote to memory of 1440 1012 LSASSMGR.EXE 245 PID 1264 wrote to memory of 968 1264 LSASSMGR.EXE 158 PID 1264 wrote to memory of 968 1264 LSASSMGR.EXE 158 PID 1264 wrote to memory of 968 1264 LSASSMGR.EXE 158 PID 1264 wrote to memory of 968 1264 LSASSMGR.EXE 158 PID 428 wrote to memory of 1556 428 LSASSMGR.EXE 217 PID 428 wrote to memory of 1556 428 LSASSMGR.EXE 217 PID 428 wrote to memory of 1556 428 LSASSMGR.EXE 217 PID 428 wrote to memory of 1556 428 LSASSMGR.EXE 217 PID 1440 wrote to memory of 1488 1440 wmiprvse.exe 135 PID 1440 wrote to memory of 1488 1440 wmiprvse.exe 135 PID 1440 wrote to memory of 1488 1440 wmiprvse.exe 135 PID 1440 wrote to memory of 1488 1440 wmiprvse.exe 135 PID 1556 wrote to memory of 1608 1556 LSASSMGR.EXE 71 PID 1556 wrote to memory of 1608 1556 LSASSMGR.EXE 71 PID 1556 wrote to memory of 1608 1556 LSASSMGR.EXE 71 PID 1556 wrote to memory of 1608 1556 LSASSMGR.EXE 71 PID 968 wrote to memory of 1584 968 LSASSMGR.EXE 72 PID 968 wrote to memory of 1584 968 LSASSMGR.EXE 72 PID 968 wrote to memory of 1584 968 LSASSMGR.EXE 72 PID 968 wrote to memory of 1584 968 LSASSMGR.EXE 72 PID 1608 wrote to memory of 1952 1608 LSASSMGR.EXE 248 PID 1608 wrote to memory of 1952 1608 LSASSMGR.EXE 248 PID 1608 wrote to memory of 1952 1608 LSASSMGR.EXE 248 PID 1608 wrote to memory of 1952 1608 LSASSMGR.EXE 248 PID 1824 wrote to memory of 1064 1824 LSASSMGR.EXE 166 PID 1824 wrote to memory of 1064 1824 LSASSMGR.EXE 166 PID 1824 wrote to memory of 1064 1824 LSASSMGR.EXE 166 PID 1824 wrote to memory of 1064 1824 LSASSMGR.EXE 166 PID 1488 wrote to memory of 1596 1488 LSASSMGR.EXE 73 PID 1488 wrote to memory of 1596 1488 LSASSMGR.EXE 73 PID 1488 wrote to memory of 1596 1488 LSASSMGR.EXE 73 PID 1488 wrote to memory of 1596 1488 LSASSMGR.EXE 73 PID 1584 wrote to memory of 1988 1584 LSASSMGR.EXE 230 PID 1584 wrote to memory of 1988 1584 LSASSMGR.EXE 230 PID 1584 wrote to memory of 1988 1584 LSASSMGR.EXE 230 PID 1584 wrote to memory of 1988 1584 LSASSMGR.EXE 230 PID 1064 wrote to memory of 2004 1064 LSASSMGR.EXE 109 PID 1064 wrote to memory of 2004 1064 LSASSMGR.EXE 109 PID 1064 wrote to memory of 2004 1064 LSASSMGR.EXE 109 PID 1064 wrote to memory of 2004 1064 LSASSMGR.EXE 109 PID 1952 wrote to memory of 2040 1952 LSASSMGR.EXE 202 PID 1952 wrote to memory of 2040 1952 LSASSMGR.EXE 202 PID 1952 wrote to memory of 2040 1952 LSASSMGR.EXE 202 PID 1952 wrote to memory of 2040 1952 LSASSMGR.EXE 202 PID 2004 wrote to memory of 652 2004 LSASSMGR.EXE 211 PID 2004 wrote to memory of 652 2004 LSASSMGR.EXE 211 PID 2004 wrote to memory of 652 2004 LSASSMGR.EXE 211 PID 2004 wrote to memory of 652 2004 LSASSMGR.EXE 211 PID 2040 wrote to memory of 612 2040 LSASSMGR.EXE 80 PID 2040 wrote to memory of 612 2040 LSASSMGR.EXE 80 PID 2040 wrote to memory of 612 2040 LSASSMGR.EXE 80 PID 2040 wrote to memory of 612 2040 LSASSMGR.EXE 80 PID 1988 wrote to memory of 1872 1988 LSASSMGR.EXE 145 PID 1988 wrote to memory of 1872 1988 LSASSMGR.EXE 145 PID 1988 wrote to memory of 1872 1988 LSASSMGR.EXE 145 PID 1988 wrote to memory of 1872 1988 LSASSMGR.EXE 145 PID 1596 wrote to memory of 668 1596 LSASSMGR.EXE 226 PID 1596 wrote to memory of 668 1596 LSASSMGR.EXE 226 PID 1596 wrote to memory of 668 1596 LSASSMGR.EXE 226 PID 1596 wrote to memory of 668 1596 LSASSMGR.EXE 226 PID 652 wrote to memory of 1632 652 LSASSMGR.EXE 210 PID 652 wrote to memory of 1632 652 LSASSMGR.EXE 210 PID 652 wrote to memory of 1632 652 LSASSMGR.EXE 210 PID 652 wrote to memory of 1632 652 LSASSMGR.EXE 210 PID 668 wrote to memory of 1496 668 LSASSMGR.EXE 85 PID 668 wrote to memory of 1496 668 LSASSMGR.EXE 85 PID 668 wrote to memory of 1496 668 LSASSMGR.EXE 85 PID 668 wrote to memory of 1496 668 LSASSMGR.EXE 85 PID 612 wrote to memory of 1616 612 LSASSMGR.EXE 84 PID 612 wrote to memory of 1616 612 LSASSMGR.EXE 84 PID 612 wrote to memory of 1616 612 LSASSMGR.EXE 84 PID 612 wrote to memory of 1616 612 LSASSMGR.EXE 84 PID 1872 wrote to memory of 1788 1872 LSASSMGR.EXE 123 PID 1872 wrote to memory of 1788 1872 LSASSMGR.EXE 123 PID 1872 wrote to memory of 1788 1872 LSASSMGR.EXE 123 PID 1872 wrote to memory of 1788 1872 LSASSMGR.EXE 123 PID 1632 wrote to memory of 1792 1632 LSASSMGR.EXE 120 PID 1632 wrote to memory of 1792 1632 LSASSMGR.EXE 120 PID 1632 wrote to memory of 1792 1632 LSASSMGR.EXE 120 PID 1632 wrote to memory of 1792 1632 LSASSMGR.EXE 120 PID 1496 wrote to memory of 1520 1496 LSASSMGR.EXE 255 PID 1496 wrote to memory of 1520 1496 LSASSMGR.EXE 255 PID 1496 wrote to memory of 1520 1496 LSASSMGR.EXE 255 PID 1496 wrote to memory of 1520 1496 LSASSMGR.EXE 255 PID 1616 wrote to memory of 1328 1616 LSASSMGR.EXE 88 PID 1616 wrote to memory of 1328 1616 LSASSMGR.EXE 88 PID 1616 wrote to memory of 1328 1616 LSASSMGR.EXE 88 PID 1616 wrote to memory of 1328 1616 LSASSMGR.EXE 88 PID 1328 wrote to memory of 1692 1328 LSASSMGR.EXE 214 PID 1328 wrote to memory of 1692 1328 LSASSMGR.EXE 214 PID 1328 wrote to memory of 1692 1328 LSASSMGR.EXE 214 PID 1328 wrote to memory of 1692 1328 LSASSMGR.EXE 214 PID 1788 wrote to memory of 1736 1788 LSASSMGR.EXE 91 PID 1788 wrote to memory of 1736 1788 LSASSMGR.EXE 91 PID 1788 wrote to memory of 1736 1788 LSASSMGR.EXE 91 PID 1788 wrote to memory of 1736 1788 LSASSMGR.EXE 91 PID 1792 wrote to memory of 1324 1792 LSASSMGR.EXE 92 PID 1792 wrote to memory of 1324 1792 LSASSMGR.EXE 92 PID 1792 wrote to memory of 1324 1792 LSASSMGR.EXE 92 PID 1792 wrote to memory of 1324 1792 LSASSMGR.EXE 92 PID 1520 wrote to memory of 1312 1520 LSASSMGR.EXE 93 PID 1520 wrote to memory of 1312 1520 LSASSMGR.EXE 93 PID 1520 wrote to memory of 1312 1520 LSASSMGR.EXE 93 PID 1520 wrote to memory of 1312 1520 LSASSMGR.EXE 93 PID 1736 wrote to memory of 1612 1736 LSASSMGR.EXE 223 PID 1736 wrote to memory of 1612 1736 LSASSMGR.EXE 223 PID 1736 wrote to memory of 1612 1736 LSASSMGR.EXE 223 PID 1736 wrote to memory of 1612 1736 LSASSMGR.EXE 223 PID 1692 wrote to memory of 1284 1692 LSASSMGR.EXE 130 PID 1692 wrote to memory of 1284 1692 LSASSMGR.EXE 130 PID 1692 wrote to memory of 1284 1692 LSASSMGR.EXE 130 PID 1692 wrote to memory of 1284 1692 LSASSMGR.EXE 130 PID 1324 wrote to memory of 1764 1324 LSASSMGR.EXE 219 PID 1324 wrote to memory of 1764 1324 LSASSMGR.EXE 219 PID 1324 wrote to memory of 1764 1324 LSASSMGR.EXE 219 PID 1324 wrote to memory of 1764 1324 LSASSMGR.EXE 219 PID 1312 wrote to memory of 428 1312 LSASSMGR.EXE 98 PID 1312 wrote to memory of 428 1312 LSASSMGR.EXE 98 PID 1312 wrote to memory of 428 1312 LSASSMGR.EXE 98 PID 1312 wrote to memory of 428 1312 LSASSMGR.EXE 98 PID 1612 wrote to memory of 1104 1612 LSASSMGR.EXE 167 PID 1612 wrote to memory of 1104 1612 LSASSMGR.EXE 167 PID 1612 wrote to memory of 1104 1612 LSASSMGR.EXE 167 PID 1612 wrote to memory of 1104 1612 LSASSMGR.EXE 167 PID 1284 wrote to memory of 1680 1284 LSASSMGR.EXE 99 PID 1284 wrote to memory of 1680 1284 LSASSMGR.EXE 99 PID 1284 wrote to memory of 1680 1284 LSASSMGR.EXE 99 PID 1284 wrote to memory of 1680 1284 LSASSMGR.EXE 99 PID 1764 wrote to memory of 1364 1764 LSASSMGR.EXE 100 PID 1764 wrote to memory of 1364 1764 LSASSMGR.EXE 100 PID 1764 wrote to memory of 1364 1764 LSASSMGR.EXE 100 PID 1764 wrote to memory of 1364 1764 LSASSMGR.EXE 100 PID 428 wrote to memory of 1256 428 LSASSMGR.EXE 196 PID 428 wrote to memory of 1256 428 LSASSMGR.EXE 196 PID 428 wrote to memory of 1256 428 LSASSMGR.EXE 196 PID 428 wrote to memory of 1256 428 LSASSMGR.EXE 196 PID 1104 wrote to memory of 1016 1104 LSASSMGR.EXE 102 PID 1104 wrote to memory of 1016 1104 LSASSMGR.EXE 102 PID 1104 wrote to memory of 1016 1104 LSASSMGR.EXE 102 PID 1104 wrote to memory of 1016 1104 LSASSMGR.EXE 102 PID 1680 wrote to memory of 268 1680 LSASSMGR.EXE 267 PID 1680 wrote to memory of 268 1680 LSASSMGR.EXE 267 PID 1680 wrote to memory of 268 1680 LSASSMGR.EXE 267 PID 1680 wrote to memory of 268 1680 LSASSMGR.EXE 267 PID 1364 wrote to memory of 1160 1364 LSASSMGR.EXE 203 PID 1364 wrote to memory of 1160 1364 LSASSMGR.EXE 203 PID 1364 wrote to memory of 1160 1364 LSASSMGR.EXE 203 PID 1364 wrote to memory of 1160 1364 LSASSMGR.EXE 203 PID 1256 wrote to memory of 360 1256 LSASSMGR.EXE 235 PID 1256 wrote to memory of 360 1256 LSASSMGR.EXE 235 PID 1256 wrote to memory of 360 1256 LSASSMGR.EXE 235 PID 1256 wrote to memory of 360 1256 LSASSMGR.EXE 235 PID 1016 wrote to memory of 2032 1016 LSASSMGR.EXE 243 PID 1016 wrote to memory of 2032 1016 LSASSMGR.EXE 243 PID 1016 wrote to memory of 2032 1016 LSASSMGR.EXE 243 PID 1016 wrote to memory of 2032 1016 LSASSMGR.EXE 243 PID 268 wrote to memory of 964 268 LSASSMGR.EXE 372 PID 268 wrote to memory of 964 268 LSASSMGR.EXE 372 PID 268 wrote to memory of 964 268 LSASSMGR.EXE 372 PID 268 wrote to memory of 964 268 LSASSMGR.EXE 372 PID 360 wrote to memory of 936 360 LSASSMGR.EXE 326 PID 360 wrote to memory of 936 360 LSASSMGR.EXE 326 PID 360 wrote to memory of 936 360 LSASSMGR.EXE 326 PID 360 wrote to memory of 936 360 LSASSMGR.EXE 326 PID 964 wrote to memory of 2004 964 LSASSMGR.EXE 416 PID 964 wrote to memory of 2004 964 LSASSMGR.EXE 416 PID 964 wrote to memory of 2004 964 LSASSMGR.EXE 416 PID 964 wrote to memory of 2004 964 LSASSMGR.EXE 416 PID 1160 wrote to memory of 2008 1160 LSASSMGR.EXE 398 PID 1160 wrote to memory of 2008 1160 LSASSMGR.EXE 398 PID 1160 wrote to memory of 2008 1160 LSASSMGR.EXE 398 PID 1160 wrote to memory of 2008 1160 LSASSMGR.EXE 398 PID 2032 wrote to memory of 1732 2032 LSASSMGR.EXE 172 PID 2032 wrote to memory of 1732 2032 LSASSMGR.EXE 172 PID 2032 wrote to memory of 1732 2032 LSASSMGR.EXE 172 PID 2032 wrote to memory of 1732 2032 LSASSMGR.EXE 172 PID 2004 wrote to memory of 652 2004 LSASSMGR.EXE 211 PID 2004 wrote to memory of 652 2004 LSASSMGR.EXE 211 PID 2004 wrote to memory of 652 2004 LSASSMGR.EXE 211 PID 2004 wrote to memory of 652 2004 LSASSMGR.EXE 211 PID 1732 wrote to memory of 1704 1732 LSASSMGR.EXE 504 PID 1732 wrote to memory of 1704 1732 LSASSMGR.EXE 504 PID 1732 wrote to memory of 1704 1732 LSASSMGR.EXE 504 PID 1732 wrote to memory of 1704 1732 LSASSMGR.EXE 504 PID 936 wrote to memory of 1316 936 LSASSMGR.EXE 486 PID 936 wrote to memory of 1316 936 LSASSMGR.EXE 486 PID 936 wrote to memory of 1316 936 LSASSMGR.EXE 486 PID 936 wrote to memory of 1316 936 LSASSMGR.EXE 486 PID 2008 wrote to memory of 912 2008 LSASSMGR.EXE 313 PID 2008 wrote to memory of 912 2008 LSASSMGR.EXE 313 PID 2008 wrote to memory of 912 2008 LSASSMGR.EXE 313 PID 2008 wrote to memory of 912 2008 LSASSMGR.EXE 313 PID 1704 wrote to memory of 1632 1704 LSASSMGR.EXE 330 PID 1704 wrote to memory of 1632 1704 LSASSMGR.EXE 330 PID 1704 wrote to memory of 1632 1704 LSASSMGR.EXE 330 PID 1704 wrote to memory of 1632 1704 LSASSMGR.EXE 330 PID 912 wrote to memory of 1672 912 LSASSMGR.EXE 117 PID 912 wrote to memory of 1672 912 LSASSMGR.EXE 117 PID 912 wrote to memory of 1672 912 LSASSMGR.EXE 117 PID 912 wrote to memory of 1672 912 LSASSMGR.EXE 117 PID 1316 wrote to memory of 1484 1316 LSASSMGR.EXE 512 PID 1316 wrote to memory of 1484 1316 LSASSMGR.EXE 512 PID 1316 wrote to memory of 1484 1316 LSASSMGR.EXE 512 PID 1316 wrote to memory of 1484 1316 LSASSMGR.EXE 512 PID 652 wrote to memory of 1564 652 LSASSMGR.EXE 560 PID 652 wrote to memory of 1564 652 LSASSMGR.EXE 560 PID 652 wrote to memory of 1564 652 LSASSMGR.EXE 560 PID 652 wrote to memory of 1564 652 LSASSMGR.EXE 560 PID 1672 wrote to memory of 1788 1672 LSASSMGR.EXE 481 PID 1672 wrote to memory of 1788 1672 LSASSMGR.EXE 481 PID 1672 wrote to memory of 1788 1672 LSASSMGR.EXE 481 PID 1672 wrote to memory of 1788 1672 LSASSMGR.EXE 481 PID 1564 wrote to memory of 1792 1564 LSASSMGR.EXE 600 PID 1564 wrote to memory of 1792 1564 LSASSMGR.EXE 600 PID 1564 wrote to memory of 1792 1564 LSASSMGR.EXE 600 PID 1564 wrote to memory of 1792 1564 LSASSMGR.EXE 600 PID 1632 wrote to memory of 960 1632 LSASSMGR.EXE 483 PID 1632 wrote to memory of 960 1632 LSASSMGR.EXE 483 PID 1632 wrote to memory of 960 1632 LSASSMGR.EXE 483 PID 1632 wrote to memory of 960 1632 LSASSMGR.EXE 483 PID 1484 wrote to memory of 1020 1484 LSASSMGR.EXE 122 PID 1484 wrote to memory of 1020 1484 LSASSMGR.EXE 122 PID 1484 wrote to memory of 1020 1484 LSASSMGR.EXE 122 PID 1484 wrote to memory of 1020 1484 LSASSMGR.EXE 122 PID 1788 wrote to memory of 812 1788 LSASSMGR.EXE 125 PID 1788 wrote to memory of 812 1788 LSASSMGR.EXE 125 PID 1788 wrote to memory of 812 1788 LSASSMGR.EXE 125 PID 1788 wrote to memory of 812 1788 LSASSMGR.EXE 125 PID 1792 wrote to memory of 1620 1792 LSASSMGR.EXE 541 PID 1792 wrote to memory of 1620 1792 LSASSMGR.EXE 541 PID 1792 wrote to memory of 1620 1792 LSASSMGR.EXE 541 PID 1792 wrote to memory of 1620 1792 LSASSMGR.EXE 541 PID 960 wrote to memory of 1700 960 LSASSMGR.EXE 673 PID 960 wrote to memory of 1700 960 LSASSMGR.EXE 673 PID 960 wrote to memory of 1700 960 LSASSMGR.EXE 673 PID 960 wrote to memory of 1700 960 LSASSMGR.EXE 673 PID 1620 wrote to memory of 744 1620 LSASSMGR.EXE 218 PID 1620 wrote to memory of 744 1620 LSASSMGR.EXE 218 PID 1620 wrote to memory of 744 1620 LSASSMGR.EXE 218 PID 1620 wrote to memory of 744 1620 LSASSMGR.EXE 218 PID 1020 wrote to memory of 1560 1020 LSASSMGR.EXE 713 PID 1020 wrote to memory of 1560 1020 LSASSMGR.EXE 713 PID 1020 wrote to memory of 1560 1020 LSASSMGR.EXE 713 PID 1020 wrote to memory of 1560 1020 LSASSMGR.EXE 713 PID 1700 wrote to memory of 1964 1700 LSASSMGR.EXE 191 PID 1700 wrote to memory of 1964 1700 LSASSMGR.EXE 191 PID 1700 wrote to memory of 1964 1700 LSASSMGR.EXE 191 PID 1700 wrote to memory of 1964 1700 LSASSMGR.EXE 191 PID 812 wrote to memory of 1284 812 LSASSMGR.EXE 130 PID 812 wrote to memory of 1284 812 LSASSMGR.EXE 130 PID 812 wrote to memory of 1284 812 LSASSMGR.EXE 130 PID 812 wrote to memory of 1284 812 LSASSMGR.EXE 130 PID 1560 wrote to memory of 852 1560 LSASSMGR.EXE 695 PID 1560 wrote to memory of 852 1560 LSASSMGR.EXE 695 PID 1560 wrote to memory of 852 1560 LSASSMGR.EXE 695 PID 1560 wrote to memory of 852 1560 LSASSMGR.EXE 695 PID 1284 wrote to memory of 1104 1284 LSASSMGR.EXE 167 PID 1284 wrote to memory of 1104 1284 LSASSMGR.EXE 167 PID 1284 wrote to memory of 1104 1284 LSASSMGR.EXE 167 PID 1284 wrote to memory of 1104 1284 LSASSMGR.EXE 167 PID 1964 wrote to memory of 1552 1964 LSASSMGR.EXE 840 PID 1964 wrote to memory of 1552 1964 LSASSMGR.EXE 840 PID 1964 wrote to memory of 1552 1964 LSASSMGR.EXE 840 PID 1964 wrote to memory of 1552 1964 LSASSMGR.EXE 840 PID 744 wrote to memory of 2036 744 LSASSMGR.EXE 598 PID 744 wrote to memory of 2036 744 LSASSMGR.EXE 598 PID 744 wrote to memory of 2036 744 LSASSMGR.EXE 598 PID 744 wrote to memory of 2036 744 LSASSMGR.EXE 598
Processes
-
C:\Users\Admin\AppData\Local\Temp\074da61af9ccb589302c910345868ab1.exe"C:\Users\Admin\AppData\Local\Temp\074da61af9ccb589302c910345868ab1.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\srtsrv32.exe"C:\Windows\system32\srtsrv32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"5⤵PID:556
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"6⤵PID:1692
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"7⤵PID:1440
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"8⤵PID:1064
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"9⤵PID:1712
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:1972 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:324 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"14⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\lssmon.exe"C:\Windows\system32\lssmon.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\srtsrv32.exe"C:\Windows\system32\srtsrv32.exe"3⤵PID:340
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"4⤵PID:1772
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"5⤵PID:1284
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"7⤵PID:1256
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"8⤵PID:2040
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"9⤵PID:2008
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\srtsrv32.exe"C:\Windows\system32\srtsrv32.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:1664 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"5⤵PID:852
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"6⤵PID:1984
-
-
-
-
-
C:\Windows\SysWOW64\srtsrv32.exe"C:\Windows\system32\srtsrv32.exe"3⤵PID:1668
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:1588 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"5⤵PID:1824
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"6⤵PID:1064
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"7⤵PID:2004
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"8⤵PID:652
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"9⤵PID:1632
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"10⤵PID:1792
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"11⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1324 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"12⤵PID:1764
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"13⤵PID:1364
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"14⤵PID:1160
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"15⤵PID:2008
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"16⤵PID:912
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"17⤵PID:1672
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"18⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
PID:1788 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"19⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
PID:812 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"20⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"21⤵PID:1104
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"22⤵PID:1980
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"23⤵PID:1160
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"24⤵PID:936
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"25⤵PID:1336
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"26⤵PID:1156
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"27⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1700 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"28⤵PID:728
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
PID:1064 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"30⤵PID:2040
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"31⤵PID:1208
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"32⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
PID:1300 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"33⤵PID:776
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"34⤵PID:1436
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"35⤵PID:1556
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"36⤵PID:1492
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"37⤵PID:1132
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
PID:2040 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"40⤵PID:936
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"41⤵PID:816
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"42⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1692 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"43⤵
- Adds Run key to start application
PID:744 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"44⤵PID:1952
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"45⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:668 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"46⤵PID:1468
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"47⤵
- Adds Run key to start application
- Drops file in Program Files directory
PID:360 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"48⤵PID:1208
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"49⤵PID:748
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"50⤵PID:1796
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"51⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1520 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"52⤵PID:1580
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"53⤵PID:944
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"54⤵PID:1980
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"55⤵PID:268
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"56⤵PID:340
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"57⤵PID:864
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"58⤵PID:1560
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"59⤵PID:592
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"60⤵PID:1696
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"61⤵PID:1788
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"62⤵PID:1176
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"63⤵PID:1436
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"64⤵PID:1560
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"65⤵PID:1984
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"66⤵PID:728
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"67⤵PID:940
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"68⤵PID:2012
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"69⤵PID:616
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"70⤵PID:928
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"71⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:964 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"72⤵PID:1176
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"73⤵PID:1980
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"74⤵PID:1836
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"75⤵PID:1976
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"76⤵PID:568
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"77⤵PID:728
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"78⤵PID:316
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"79⤵PID:616
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"80⤵PID:1000
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"81⤵PID:1668
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"82⤵PID:556
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"83⤵PID:2012
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"84⤵PID:1316
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"85⤵PID:1560
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"86⤵PID:2032
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"87⤵PID:1132
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"88⤵PID:820
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"89⤵PID:1836
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"90⤵PID:928
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"91⤵PID:1560
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"92⤵PID:1668
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"93⤵PID:1564
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"94⤵PID:1328
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"95⤵PID:428
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"96⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1316 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"97⤵PID:892
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"98⤵PID:1636
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"99⤵PID:1112
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"100⤵PID:452
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"101⤵
- Drops file in System32 directory
PID:1484 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"102⤵PID:1564
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"103⤵PID:528
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"104⤵PID:1704
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"105⤵PID:952
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"106⤵PID:428
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"107⤵PID:1548
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"108⤵
- Drops file in System32 directory
PID:1620 -
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"109⤵PID:1580
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"110⤵PID:964
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"111⤵PID:1952
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"112⤵PID:936
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"113⤵PID:840
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"114⤵PID:888
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"115⤵PID:928
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"116⤵PID:612
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"117⤵PID:2008
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"118⤵PID:816
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"119⤵PID:1772
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"120⤵PID:2012
-
C:\Windows\SysWOW64\LSASSMGR.EXE"C:\Windows\system32\LSASSMGR.EXE"121⤵PID:1716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-