Analysis
-
max time kernel
162s -
max time network
133s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01/02/2022, 15:29
Static task
static1
Behavioral task
behavioral1
Sample
c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe
-
Size
669KB
-
MD5
187c968c9c7f70a8c65ebefac8e4f124
-
SHA1
b5ec574920e42f117024e60852968da4f0584ff0
-
SHA256
c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e
-
SHA512
f4d21feb6518d2712e829f5b3e8209b76851ab7ae66e2673fef08545f085bf3ece191b37bcce14074eb2c3fc50de83339ac9bee92769a20b94886289554fa3f6
Malware Config
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker Payload 2 IoCs
resource yara_rule behavioral1/files/0x000800000001224b-55.dat family_medusalocker behavioral1/files/0x000800000001224b-56.dat family_medusalocker -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
pid Process 1476 svhost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-3846991908-3261386348-1409841751-1000\desktop.ini c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\N: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\P: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\Q: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\X: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\B: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\J: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\S: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\Z: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\A: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\K: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\M: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\Y: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\H: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\F: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\G: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\L: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\O: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\R: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\T: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\U: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\E: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\W: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\V: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 676 vssadmin.exe 1992 vssadmin.exe 1952 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeBackupPrivilege 580 vssvc.exe Token: SeRestorePrivilege 580 vssvc.exe Token: SeAuditPrivilege 580 vssvc.exe Token: SeIncreaseQuotaPrivilege 1868 wmic.exe Token: SeSecurityPrivilege 1868 wmic.exe Token: SeTakeOwnershipPrivilege 1868 wmic.exe Token: SeLoadDriverPrivilege 1868 wmic.exe Token: SeSystemProfilePrivilege 1868 wmic.exe Token: SeSystemtimePrivilege 1868 wmic.exe Token: SeProfSingleProcessPrivilege 1868 wmic.exe Token: SeIncBasePriorityPrivilege 1868 wmic.exe Token: SeCreatePagefilePrivilege 1868 wmic.exe Token: SeBackupPrivilege 1868 wmic.exe Token: SeRestorePrivilege 1868 wmic.exe Token: SeShutdownPrivilege 1868 wmic.exe Token: SeDebugPrivilege 1868 wmic.exe Token: SeSystemEnvironmentPrivilege 1868 wmic.exe Token: SeRemoteShutdownPrivilege 1868 wmic.exe Token: SeUndockPrivilege 1868 wmic.exe Token: SeManageVolumePrivilege 1868 wmic.exe Token: 33 1868 wmic.exe Token: 34 1868 wmic.exe Token: 35 1868 wmic.exe Token: SeIncreaseQuotaPrivilege 1932 wmic.exe Token: SeSecurityPrivilege 1932 wmic.exe Token: SeTakeOwnershipPrivilege 1932 wmic.exe Token: SeLoadDriverPrivilege 1932 wmic.exe Token: SeSystemProfilePrivilege 1932 wmic.exe Token: SeSystemtimePrivilege 1932 wmic.exe Token: SeProfSingleProcessPrivilege 1932 wmic.exe Token: SeIncBasePriorityPrivilege 1932 wmic.exe Token: SeCreatePagefilePrivilege 1932 wmic.exe Token: SeBackupPrivilege 1932 wmic.exe Token: SeRestorePrivilege 1932 wmic.exe Token: SeShutdownPrivilege 1932 wmic.exe Token: SeDebugPrivilege 1932 wmic.exe Token: SeSystemEnvironmentPrivilege 1932 wmic.exe Token: SeRemoteShutdownPrivilege 1932 wmic.exe Token: SeUndockPrivilege 1932 wmic.exe Token: SeManageVolumePrivilege 1932 wmic.exe Token: 33 1932 wmic.exe Token: 34 1932 wmic.exe Token: 35 1932 wmic.exe Token: SeIncreaseQuotaPrivilege 1796 wmic.exe Token: SeSecurityPrivilege 1796 wmic.exe Token: SeTakeOwnershipPrivilege 1796 wmic.exe Token: SeLoadDriverPrivilege 1796 wmic.exe Token: SeSystemProfilePrivilege 1796 wmic.exe Token: SeSystemtimePrivilege 1796 wmic.exe Token: SeProfSingleProcessPrivilege 1796 wmic.exe Token: SeIncBasePriorityPrivilege 1796 wmic.exe Token: SeCreatePagefilePrivilege 1796 wmic.exe Token: SeBackupPrivilege 1796 wmic.exe Token: SeRestorePrivilege 1796 wmic.exe Token: SeShutdownPrivilege 1796 wmic.exe Token: SeDebugPrivilege 1796 wmic.exe Token: SeSystemEnvironmentPrivilege 1796 wmic.exe Token: SeRemoteShutdownPrivilege 1796 wmic.exe Token: SeUndockPrivilege 1796 wmic.exe Token: SeManageVolumePrivilege 1796 wmic.exe Token: 33 1796 wmic.exe Token: 34 1796 wmic.exe Token: 35 1796 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1820 wrote to memory of 676 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 27 PID 1820 wrote to memory of 676 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 27 PID 1820 wrote to memory of 676 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 27 PID 1820 wrote to memory of 676 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 27 PID 1820 wrote to memory of 1868 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 30 PID 1820 wrote to memory of 1868 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 30 PID 1820 wrote to memory of 1868 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 30 PID 1820 wrote to memory of 1868 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 30 PID 1820 wrote to memory of 1992 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 32 PID 1820 wrote to memory of 1992 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 32 PID 1820 wrote to memory of 1992 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 32 PID 1820 wrote to memory of 1992 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 32 PID 1820 wrote to memory of 1932 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 34 PID 1820 wrote to memory of 1932 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 34 PID 1820 wrote to memory of 1932 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 34 PID 1820 wrote to memory of 1932 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 34 PID 1820 wrote to memory of 1952 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 36 PID 1820 wrote to memory of 1952 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 36 PID 1820 wrote to memory of 1952 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 36 PID 1820 wrote to memory of 1952 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 36 PID 1820 wrote to memory of 1796 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 38 PID 1820 wrote to memory of 1796 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 38 PID 1820 wrote to memory of 1796 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 38 PID 1820 wrote to memory of 1796 1820 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 38 PID 836 wrote to memory of 1476 836 taskeng.exe 42 PID 836 wrote to memory of 1476 836 taskeng.exe 42 PID 836 wrote to memory of 1476 836 taskeng.exe 42 PID 836 wrote to memory of 1476 836 taskeng.exe 42 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe"C:\Users\Admin\AppData\Local\Temp\c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe"1⤵
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1820 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:676
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1868
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1992
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1932
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1952
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1796
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:580
-
C:\Windows\system32\taskeng.exetaskeng.exe {CD78F403-C2F2-42A5-93DD-A0B4ED3822A1} S-1-5-21-3846991908-3261386348-1409841751-1000:VQVVOAJK\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe2⤵
- Executes dropped EXE
PID:1476
-