Overview
overview
10Static
static
1008751be484...2d.dll
windows7_x64
1008751be484...2d.dll
windows10_x64
100a9f79abd4...51.exe
windows7_x64
30a9f79abd4...51.exe
windows10_x64
30di3x.bin.exe
windows7_x64
100di3x.bin.exe
windows10_x64
101.bin/1.exe
windows7_x64
101.bin/1.exe
windows10_x64
104a30275f14...ab.dll
windows7_x64
104a30275f14...ab.dll
windows10_x64
12019-09-02...10.exe
windows7_x64
102019-09-02...10.exe
windows10_x64
102b5e50bc30...ba.dll
windows7_x64
102b5e50bc30...ba.dll
windows10_x64
102c01b00772...eb.exe
windows7_x64
102c01b00772...eb.exe
windows10_x64
131.exe
windows7_x64
1031.exe
windows10_x64
103DMark 11 ...on.exe
windows7_x64
13DMark 11 ...on.exe
windows10_x64
142f9729255...61.exe
windows7_x64
1042f9729255...61.exe
windows10_x64
1042f9729255...1).exe
windows7_x64
1042f9729255...1).exe
windows10_x64
105da0116af4...18.exe
windows7_x64
85da0116af4...18.exe
windows10_x64
869c56d12ed...6b.exe
windows7_x64
1069c56d12ed...6b.exe
windows10_x64
106a9e7107c9...91.exe
windows7_x64
106a9e7107c9...91.exe
windows10_x64
10905d572f23...50.exe
windows7_x64
1905d572f23...50.exe
windows10_x64
1Resubmissions
03-07-2024 16:04
240703-thygmaycpc 1001-07-2024 18:12
240701-ws6xvswbkj 1001-07-2024 18:03
240701-wm5sls1gka 1001-07-2024 18:03
240701-wm39sa1gjf 1001-07-2024 18:03
240701-wm2e7avhkj 1001-07-2024 18:03
240701-wmzxcs1fre 1001-07-2024 18:02
240701-wmzats1frc 1001-07-2024 18:02
240701-wmvbwa1fqh 1022-11-2023 17:02
231122-vkac9adg64 10Analysis
-
max time kernel
153s -
max time network
157s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 19:24
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
0di3x.bin.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral6
Sample
0di3x.bin.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral7
Sample
1.bin/1.exe
Resource
win7v20201028
agentteslaformbookqakbotraccoonspx1291590734339agilenetbankercoreentitycryptonekeyloggerpackerransomwareratrezer0spywarestealertrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral8
Sample
1.bin/1.exe
Resource
win10v20201028
agenttesladanabotdharmaformbookqakbotraccoonspx1291590734339agilenetbankerbotnetcoreentitycryptoneevasionkeyloggerpackerpersistenceransomwareratrezer0spywarestealertrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral9
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral10
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral11
Sample
2019-09-02_22-41-10.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral12
Sample
2019-09-02_22-41-10.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral13
Sample
2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral14
Sample
2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral15
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral16
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral17
Sample
31.exe
Resource
win7v20201028
agentteslaformbookqakbotraccoonspx1291590734339agilenetbankercoreentitycryptonekeyloggerpackerransomwareratrezer0spywarestealertrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral18
Sample
31.exe
Resource
win10v20201028
agenttesladanabotdharmaformbookqakbotraccoonspx1291590734339agilenetbankerbotnetcoreentitycryptoneevasionkeyloggerpackerpersistenceransomwareratrezer0spywarestealertrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral19
Sample
3DMark 11 Advanced Edition.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral20
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral21
Sample
42f972925508a82236e8533567487761.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral22
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral23
Sample
42f972925508a82236e8533567487761(1).exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral24
Sample
42f972925508a82236e8533567487761(1).exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral25
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral26
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral27
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral28
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral29
Sample
6a9e7107c97762eb1196a64baeadb291.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral30
Sample
6a9e7107c97762eb1196a64baeadb291.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral31
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral32
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
2c01b007729230c415420ad641ad92eb.exe
-
Size
1.3MB
-
MD5
daef338f9c47d5394b7e1e60ce38d02d
-
SHA1
c0a07e8c32528d29aae26aaecbf6a67ed95b8c8e
-
SHA256
5d03fd083b626a5516194d5e94576349100c9c98ca7d6845642ed9579980ca58
-
SHA512
d0f4050fc2c5f38ab598729fb6930c84bf779d47b5a8b4e860bc0e9ca8be454ad5dce001d8f88299d8a079eafd4c26efcdd2d196352acfe45e940cc107fcebf4
Malware Config
Signatures
-
NirSoft MailPassView 5 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral15/memory/1796-25-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral15/memory/1796-26-0x000000000047EAEE-mapping.dmp MailPassView behavioral15/memory/1832-35-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral15/memory/1832-36-0x0000000000411654-mapping.dmp MailPassView behavioral15/memory/1832-39-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 5 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral15/memory/1796-25-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral15/memory/1796-26-0x000000000047EAEE-mapping.dmp WebBrowserPassView behavioral15/memory/1068-40-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral15/memory/1068-41-0x0000000000442628-mapping.dmp WebBrowserPassView behavioral15/memory/1068-43-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 8 IoCs
resource yara_rule behavioral15/memory/1796-25-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral15/memory/1796-26-0x000000000047EAEE-mapping.dmp Nirsoft behavioral15/memory/1832-35-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral15/memory/1832-36-0x0000000000411654-mapping.dmp Nirsoft behavioral15/memory/1832-39-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral15/memory/1068-40-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral15/memory/1068-41-0x0000000000442628-mapping.dmp Nirsoft behavioral15/memory/1068-43-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Executes dropped EXE 2 IoCs
pid Process 1708 odm.exe 548 odm.exe -
Loads dropped DLL 5 IoCs
pid Process 1628 2c01b007729230c415420ad641ad92eb.exe 1628 2c01b007729230c415420ad641ad92eb.exe 1628 2c01b007729230c415420ad641ad92eb.exe 1628 2c01b007729230c415420ad641ad92eb.exe 1708 odm.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex" odm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run RegSvcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex" RegSvcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run odm.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 whatismyipaddress.com -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 548 set thread context of 1796 548 odm.exe 33 PID 548 set thread context of 996 548 odm.exe 34 PID 1796 set thread context of 1832 1796 RegSvcs.exe 36 PID 1796 set thread context of 1068 1796 RegSvcs.exe 37 -
Suspicious behavior: EnumeratesProcesses 1011 IoCs
pid Process 1708 odm.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 1068 vbc.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1980 DllHost.exe -
Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 1628 wrote to memory of 1708 1628 2c01b007729230c415420ad641ad92eb.exe 27 PID 1628 wrote to memory of 1708 1628 2c01b007729230c415420ad641ad92eb.exe 27 PID 1628 wrote to memory of 1708 1628 2c01b007729230c415420ad641ad92eb.exe 27 PID 1628 wrote to memory of 1708 1628 2c01b007729230c415420ad641ad92eb.exe 27 PID 1628 wrote to memory of 1708 1628 2c01b007729230c415420ad641ad92eb.exe 27 PID 1628 wrote to memory of 1708 1628 2c01b007729230c415420ad641ad92eb.exe 27 PID 1628 wrote to memory of 1708 1628 2c01b007729230c415420ad641ad92eb.exe 27 PID 1708 wrote to memory of 548 1708 odm.exe 32 PID 1708 wrote to memory of 548 1708 odm.exe 32 PID 1708 wrote to memory of 548 1708 odm.exe 32 PID 1708 wrote to memory of 548 1708 odm.exe 32 PID 1708 wrote to memory of 548 1708 odm.exe 32 PID 1708 wrote to memory of 548 1708 odm.exe 32 PID 1708 wrote to memory of 548 1708 odm.exe 32 PID 548 wrote to memory of 1796 548 odm.exe 33 PID 548 wrote to memory of 1796 548 odm.exe 33 PID 548 wrote to memory of 1796 548 odm.exe 33 PID 548 wrote to memory of 1796 548 odm.exe 33 PID 548 wrote to memory of 1796 548 odm.exe 33 PID 548 wrote to memory of 1796 548 odm.exe 33 PID 548 wrote to memory of 1796 548 odm.exe 33 PID 548 wrote to memory of 1796 548 odm.exe 33 PID 548 wrote to memory of 1796 548 odm.exe 33 PID 548 wrote to memory of 1796 548 odm.exe 33 PID 548 wrote to memory of 1796 548 odm.exe 33 PID 548 wrote to memory of 1796 548 odm.exe 33 PID 548 wrote to memory of 996 548 odm.exe 34 PID 548 wrote to memory of 996 548 odm.exe 34 PID 548 wrote to memory of 996 548 odm.exe 34 PID 548 wrote to memory of 996 548 odm.exe 34 PID 548 wrote to memory of 996 548 odm.exe 34 PID 548 wrote to memory of 996 548 odm.exe 34 PID 548 wrote to memory of 996 548 odm.exe 34 PID 548 wrote to memory of 996 548 odm.exe 34 PID 548 wrote to memory of 996 548 odm.exe 34 PID 1796 wrote to memory of 1832 1796 RegSvcs.exe 36 PID 1796 wrote to memory of 1832 1796 RegSvcs.exe 36 PID 1796 wrote to memory of 1832 1796 RegSvcs.exe 36 PID 1796 wrote to memory of 1832 1796 RegSvcs.exe 36 PID 1796 wrote to memory of 1832 1796 RegSvcs.exe 36 PID 1796 wrote to memory of 1832 1796 RegSvcs.exe 36 PID 1796 wrote to memory of 1832 1796 RegSvcs.exe 36 PID 1796 wrote to memory of 1832 1796 RegSvcs.exe 36 PID 1796 wrote to memory of 1832 1796 RegSvcs.exe 36 PID 1796 wrote to memory of 1832 1796 RegSvcs.exe 36 PID 1796 wrote to memory of 1832 1796 RegSvcs.exe 36 PID 1796 wrote to memory of 1832 1796 RegSvcs.exe 36 PID 1796 wrote to memory of 1832 1796 RegSvcs.exe 36 PID 1796 wrote to memory of 1068 1796 RegSvcs.exe 37 PID 1796 wrote to memory of 1068 1796 RegSvcs.exe 37 PID 1796 wrote to memory of 1068 1796 RegSvcs.exe 37 PID 1796 wrote to memory of 1068 1796 RegSvcs.exe 37 PID 1796 wrote to memory of 1068 1796 RegSvcs.exe 37 PID 1796 wrote to memory of 1068 1796 RegSvcs.exe 37 PID 1796 wrote to memory of 1068 1796 RegSvcs.exe 37 PID 1796 wrote to memory of 1068 1796 RegSvcs.exe 37 PID 1796 wrote to memory of 1068 1796 RegSvcs.exe 37 PID 1796 wrote to memory of 1068 1796 RegSvcs.exe 37 PID 1796 wrote to memory of 1068 1796 RegSvcs.exe 37 PID 1796 wrote to memory of 1068 1796 RegSvcs.exe 37 PID 1796 wrote to memory of 1068 1796 RegSvcs.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe"C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Roaming\wou\odm.exe"C:\Users\Admin\AppData\Roaming\wou\odm.exe" kja-pex2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Roaming\wou\odm.exeC:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\WCNDU3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"5⤵PID:1832
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"5⤵PID:1068
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeC:\Users\Admin\AppData\Roaming\wou\WCNDU4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:996
-
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
PID:1980