Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
189s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 20:17
Static task
static1
Behavioral task
behavioral1
Sample
9672f07998972e5b99344a9e68b8024fa3ac9715195ecf90c74d9dceda72d9a6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9672f07998972e5b99344a9e68b8024fa3ac9715195ecf90c74d9dceda72d9a6.exe
Resource
win10v2004-20220812-en
General
-
Target
9672f07998972e5b99344a9e68b8024fa3ac9715195ecf90c74d9dceda72d9a6.exe
-
Size
21KB
-
MD5
42813bf853e513b71ba3c057c2fa1e50
-
SHA1
3df272a1dae28ed1324d36fa09aa0197b2b757b3
-
SHA256
9672f07998972e5b99344a9e68b8024fa3ac9715195ecf90c74d9dceda72d9a6
-
SHA512
2fc66ba2ec32afd17e2e82a9d97057078bac45bd7c9f4fae6d3915147e3c22e0982a5fab26db8c64106e42818e4b2210f4b5cc58cf9e8c6f6679dbd22dd6ac8c
-
SSDEEP
384:36SQ9KaonyYFtYqS7j1c1Nbj+AdSIFRCjn+nAOPxMd1YWVpd72KlJb0aJ:eKzyEtanK1F7d1Qn+nAOcPd71lJbt
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2388 SVCH0ST.EXE 4468 SVCH0ST.EXE 364 SVCH0ST.EXE 756 SVCH0ST.EXE 3336 SVCH0ST.EXE 3488 SVCH0ST.EXE 3520 SVCH0ST.EXE 4584 SVCH0ST.EXE 4348 SVCH0ST.EXE 1856 SVCH0ST.EXE 3800 SVCH0ST.EXE 2300 SVCH0ST.EXE 1980 SVCH0ST.EXE 4932 SVCH0ST.EXE 3252 SVCH0ST.EXE 2528 SVCH0ST.EXE 3392 SVCH0ST.EXE 2664 SVCH0ST.EXE 1872 SVCH0ST.EXE 4176 SVCH0ST.EXE 856 SVCH0ST.EXE 3860 SVCH0ST.EXE 4528 SVCH0ST.EXE 4796 SVCH0ST.EXE 1512 SVCH0ST.EXE 1332 SVCH0ST.EXE 1880 SVCH0ST.EXE 2252 SVCH0ST.EXE 4264 SVCH0ST.EXE 3912 SVCH0ST.EXE 1696 SVCH0ST.EXE 4948 SVCH0ST.EXE 1336 SVCH0ST.EXE 4648 SVCH0ST.EXE 4804 SVCH0ST.EXE 808 SVCH0ST.EXE 2012 SVCH0ST.EXE 3948 SVCH0ST.EXE 620 SVCH0ST.EXE 3336 SVCH0ST.EXE 3488 SVCH0ST.EXE 2348 SVCH0ST.EXE 3888 SVCH0ST.EXE 3596 SVCH0ST.EXE 3340 SVCH0ST.EXE 4596 SVCH0ST.EXE 1936 SVCH0ST.EXE 3496 SVCH0ST.EXE 1356 SVCH0ST.EXE 3608 SVCH0ST.EXE 3832 SVCH0ST.EXE 4228 SVCH0ST.EXE 3444 SVCH0ST.EXE 4824 SVCH0ST.EXE 2964 SVCH0ST.EXE 3180 SVCH0ST.EXE 4828 SVCH0ST.EXE 4292 SVCH0ST.EXE 2208 SVCH0ST.EXE 4544 SVCH0ST.EXE 4564 SVCH0ST.EXE 2564 SVCH0ST.EXE 1512 SVCH0ST.EXE 1324 SVCH0ST.EXE -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SVCH0ST.EXE -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\mmdat.dat SVCH0ST.EXE File opened for modification C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\Windows\SysWOW64\mmdat.dat SVCH0ST.EXE File opened for modification C:\Windows\SysWOW64\mmdat.dat SVCH0ST.EXE File opened for modification C:\Windows\SysWOW64\mmdat.dat SVCH0ST.EXE File opened for modification C:\Windows\SysWOW64\mmdat.dat SVCH0ST.EXE File created C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\Windows\SysWOW64\mmdat.dat SVCH0ST.EXE File created C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\Windows\SysWOW64\mmdat.dat SVCH0ST.EXE File created C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\Windows\SysWOW64\mmdat.dat SVCH0ST.EXE File opened for modification C:\Windows\SysWOW64\mmdat.dat SVCH0ST.EXE File opened for modification C:\Windows\SysWOW64\mmdat.dat SVCH0ST.EXE File opened for modification C:\Windows\SysWOW64\mmdat.dat SVCH0ST.EXE File opened for modification C:\Windows\SysWOW64\mmdat.dat SVCH0ST.EXE File opened for modification C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\Windows\SysWOW64\mmdat.dat SVCH0ST.EXE File created C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File created C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File created C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\Windows\SysWOW64\mmdat.dat SVCH0ST.EXE File created C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\Windows\SysWOW64\mmdat.dat SVCH0ST.EXE File created C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File created C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\Windows\SysWOW64\mmdat.dat SVCH0ST.EXE File opened for modification C:\Windows\SysWOW64\mmdat.dat SVCH0ST.EXE File opened for modification C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\Windows\SysWOW64\mmdat.dat SVCH0ST.EXE File created C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\Windows\SysWOW64\mmdat.dat SVCH0ST.EXE File opened for modification C:\Windows\SysWOW64\mmdat.dat SVCH0ST.EXE File opened for modification C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\Windows\SysWOW64\mmdat.dat SVCH0ST.EXE File opened for modification C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File created C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\Windows\SysWOW64\mmdat.dat SVCH0ST.EXE File opened for modification C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File created C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File created C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File created C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\Windows\SysWOW64\mmdat.dat SVCH0ST.EXE File created C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\Windows\SysWOW64\mmdat.dat SVCH0ST.EXE File created C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File created C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\Windows\SysWOW64\mmdat.dat SVCH0ST.EXE File opened for modification C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE File opened for modification C:\WINDOWS\SysWOW64\SVCH0ST.EXE SVCH0ST.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2220 9672f07998972e5b99344a9e68b8024fa3ac9715195ecf90c74d9dceda72d9a6.exe 2388 SVCH0ST.EXE 4468 SVCH0ST.EXE 364 SVCH0ST.EXE 756 SVCH0ST.EXE 3336 SVCH0ST.EXE 3488 SVCH0ST.EXE 3520 SVCH0ST.EXE 4584 SVCH0ST.EXE 4348 SVCH0ST.EXE 1856 SVCH0ST.EXE 3800 SVCH0ST.EXE 2300 SVCH0ST.EXE 1980 SVCH0ST.EXE 4932 SVCH0ST.EXE 3252 SVCH0ST.EXE 2528 SVCH0ST.EXE 3392 SVCH0ST.EXE 2664 SVCH0ST.EXE 1872 SVCH0ST.EXE 4176 SVCH0ST.EXE 856 SVCH0ST.EXE 3860 SVCH0ST.EXE 4528 SVCH0ST.EXE 4796 SVCH0ST.EXE 1512 SVCH0ST.EXE 1332 SVCH0ST.EXE 1880 SVCH0ST.EXE 2252 SVCH0ST.EXE 4264 SVCH0ST.EXE 3912 SVCH0ST.EXE 1696 SVCH0ST.EXE 1336 SVCH0ST.EXE 4648 SVCH0ST.EXE 4804 SVCH0ST.EXE 808 SVCH0ST.EXE 2012 SVCH0ST.EXE 3948 SVCH0ST.EXE 620 SVCH0ST.EXE 3336 SVCH0ST.EXE 3488 SVCH0ST.EXE 2348 SVCH0ST.EXE 3888 SVCH0ST.EXE 3596 SVCH0ST.EXE 3340 SVCH0ST.EXE 4596 SVCH0ST.EXE 1936 SVCH0ST.EXE 3496 SVCH0ST.EXE 1356 SVCH0ST.EXE 3608 SVCH0ST.EXE 3832 SVCH0ST.EXE 4228 SVCH0ST.EXE 3444 SVCH0ST.EXE 4824 SVCH0ST.EXE 2964 SVCH0ST.EXE 3180 SVCH0ST.EXE 4828 SVCH0ST.EXE 4292 SVCH0ST.EXE 2208 SVCH0ST.EXE 4544 SVCH0ST.EXE 4564 SVCH0ST.EXE 2564 SVCH0ST.EXE 1512 SVCH0ST.EXE 1324 SVCH0ST.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2388 2220 9672f07998972e5b99344a9e68b8024fa3ac9715195ecf90c74d9dceda72d9a6.exe 80 PID 2220 wrote to memory of 2388 2220 9672f07998972e5b99344a9e68b8024fa3ac9715195ecf90c74d9dceda72d9a6.exe 80 PID 2220 wrote to memory of 2388 2220 9672f07998972e5b99344a9e68b8024fa3ac9715195ecf90c74d9dceda72d9a6.exe 80 PID 2388 wrote to memory of 4468 2388 SVCH0ST.EXE 81 PID 2388 wrote to memory of 4468 2388 SVCH0ST.EXE 81 PID 2388 wrote to memory of 4468 2388 SVCH0ST.EXE 81 PID 4468 wrote to memory of 364 4468 SVCH0ST.EXE 82 PID 4468 wrote to memory of 364 4468 SVCH0ST.EXE 82 PID 4468 wrote to memory of 364 4468 SVCH0ST.EXE 82 PID 364 wrote to memory of 756 364 SVCH0ST.EXE 83 PID 364 wrote to memory of 756 364 SVCH0ST.EXE 83 PID 364 wrote to memory of 756 364 SVCH0ST.EXE 83 PID 756 wrote to memory of 3336 756 SVCH0ST.EXE 84 PID 756 wrote to memory of 3336 756 SVCH0ST.EXE 84 PID 756 wrote to memory of 3336 756 SVCH0ST.EXE 84 PID 3336 wrote to memory of 3488 3336 SVCH0ST.EXE 85 PID 3336 wrote to memory of 3488 3336 SVCH0ST.EXE 85 PID 3336 wrote to memory of 3488 3336 SVCH0ST.EXE 85 PID 3488 wrote to memory of 3520 3488 SVCH0ST.EXE 86 PID 3488 wrote to memory of 3520 3488 SVCH0ST.EXE 86 PID 3488 wrote to memory of 3520 3488 SVCH0ST.EXE 86 PID 3520 wrote to memory of 4584 3520 SVCH0ST.EXE 87 PID 3520 wrote to memory of 4584 3520 SVCH0ST.EXE 87 PID 3520 wrote to memory of 4584 3520 SVCH0ST.EXE 87 PID 4584 wrote to memory of 4348 4584 SVCH0ST.EXE 88 PID 4584 wrote to memory of 4348 4584 SVCH0ST.EXE 88 PID 4584 wrote to memory of 4348 4584 SVCH0ST.EXE 88 PID 4348 wrote to memory of 1856 4348 SVCH0ST.EXE 89 PID 4348 wrote to memory of 1856 4348 SVCH0ST.EXE 89 PID 4348 wrote to memory of 1856 4348 SVCH0ST.EXE 89 PID 1856 wrote to memory of 3800 1856 SVCH0ST.EXE 90 PID 1856 wrote to memory of 3800 1856 SVCH0ST.EXE 90 PID 1856 wrote to memory of 3800 1856 SVCH0ST.EXE 90 PID 3800 wrote to memory of 2300 3800 SVCH0ST.EXE 91 PID 3800 wrote to memory of 2300 3800 SVCH0ST.EXE 91 PID 3800 wrote to memory of 2300 3800 SVCH0ST.EXE 91 PID 2300 wrote to memory of 1980 2300 SVCH0ST.EXE 92 PID 2300 wrote to memory of 1980 2300 SVCH0ST.EXE 92 PID 2300 wrote to memory of 1980 2300 SVCH0ST.EXE 92 PID 1980 wrote to memory of 4932 1980 SVCH0ST.EXE 93 PID 1980 wrote to memory of 4932 1980 SVCH0ST.EXE 93 PID 1980 wrote to memory of 4932 1980 SVCH0ST.EXE 93 PID 4932 wrote to memory of 3252 4932 SVCH0ST.EXE 94 PID 4932 wrote to memory of 3252 4932 SVCH0ST.EXE 94 PID 4932 wrote to memory of 3252 4932 SVCH0ST.EXE 94 PID 3252 wrote to memory of 2528 3252 SVCH0ST.EXE 95 PID 3252 wrote to memory of 2528 3252 SVCH0ST.EXE 95 PID 3252 wrote to memory of 2528 3252 SVCH0ST.EXE 95 PID 2528 wrote to memory of 3392 2528 SVCH0ST.EXE 96 PID 2528 wrote to memory of 3392 2528 SVCH0ST.EXE 96 PID 2528 wrote to memory of 3392 2528 SVCH0ST.EXE 96 PID 3392 wrote to memory of 2664 3392 SVCH0ST.EXE 97 PID 3392 wrote to memory of 2664 3392 SVCH0ST.EXE 97 PID 3392 wrote to memory of 2664 3392 SVCH0ST.EXE 97 PID 2664 wrote to memory of 1872 2664 SVCH0ST.EXE 98 PID 2664 wrote to memory of 1872 2664 SVCH0ST.EXE 98 PID 2664 wrote to memory of 1872 2664 SVCH0ST.EXE 98 PID 1872 wrote to memory of 4176 1872 SVCH0ST.EXE 99 PID 1872 wrote to memory of 4176 1872 SVCH0ST.EXE 99 PID 1872 wrote to memory of 4176 1872 SVCH0ST.EXE 99 PID 4176 wrote to memory of 856 4176 SVCH0ST.EXE 100 PID 4176 wrote to memory of 856 4176 SVCH0ST.EXE 100 PID 4176 wrote to memory of 856 4176 SVCH0ST.EXE 100 PID 856 wrote to memory of 3860 856 SVCH0ST.EXE 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\9672f07998972e5b99344a9e68b8024fa3ac9715195ecf90c74d9dceda72d9a6.exe"C:\Users\Admin\AppData\Local\Temp\9672f07998972e5b99344a9e68b8024fa3ac9715195ecf90c74d9dceda72d9a6.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:364 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"6⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"8⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"11⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"14⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"16⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"17⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"18⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"19⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"20⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"22⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"23⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3860 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"24⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4528 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"25⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4796 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"26⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1512 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"27⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1332 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"28⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1880 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2252 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"30⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:4264 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"31⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:3912 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"32⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1696 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"33⤵
- Executes dropped EXE
PID:4948 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"34⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1336 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"35⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4648 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"36⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4804 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:808 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"38⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:2012 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"39⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3948 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"40⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:620 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"41⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3336 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"42⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3488 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"43⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2348 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"44⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3888 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"45⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3596 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"46⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3340 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"47⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:4596 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"48⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1936 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"49⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3496 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"50⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1356 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"51⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3608 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"52⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3832 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"53⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4228 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"54⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3444 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"55⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4824 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"56⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:2964 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"57⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:3180 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"58⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4828 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:4292 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"60⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2208 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"61⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4544 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"62⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4564 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"63⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2564 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"64⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1512 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"65⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1324 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"66⤵PID:2324
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"67⤵
- Drops file in System32 directory
PID:1392 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"68⤵PID:4284
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"69⤵PID:1284
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"70⤵PID:4948
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"71⤵PID:2304
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"72⤵PID:4648
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"73⤵
- Checks computer location settings
PID:4724 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"74⤵
- Checks computer location settings
PID:4928 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"75⤵PID:2012
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"76⤵PID:4944
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"77⤵PID:2064
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"78⤵PID:112
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"79⤵
- Drops file in System32 directory
PID:4600 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"80⤵PID:1280
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"81⤵PID:3504
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"82⤵
- Drops file in System32 directory
PID:3892 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"83⤵PID:3536
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"84⤵
- Drops file in System32 directory
PID:3940 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"85⤵PID:3440
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"86⤵PID:524
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"87⤵
- Drops file in System32 directory
PID:2140 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"88⤵PID:4684
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"89⤵
- Checks computer location settings
PID:3108 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"90⤵
- Drops file in System32 directory
PID:3900 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"91⤵PID:2896
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"92⤵PID:4304
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"93⤵PID:4552
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"94⤵
- Checks computer location settings
PID:4484 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"95⤵PID:4720
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"96⤵PID:2804
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"97⤵
- Drops file in System32 directory
PID:3852 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"98⤵PID:2960
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"99⤵PID:3332
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"100⤵
- Drops file in System32 directory
PID:1620 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"101⤵PID:2724
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"102⤵
- Checks computer location settings
PID:1560 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"103⤵PID:5036
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"104⤵PID:4264
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"105⤵
- Drops file in System32 directory
PID:1284 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"106⤵
- Checks computer location settings
PID:4812 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"107⤵PID:5112
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"108⤵
- Drops file in System32 directory
PID:456 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"109⤵
- Drops file in System32 directory
PID:2176 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"110⤵
- Drops file in System32 directory
PID:2420 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"111⤵PID:4916
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"112⤵
- Checks computer location settings
PID:3140 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"113⤵PID:216
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"114⤵PID:1592
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"115⤵PID:4568
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"116⤵PID:3704
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"117⤵PID:4856
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"118⤵PID:3084
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"119⤵
- Checks computer location settings
PID:4596 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"120⤵
- Checks computer location settings
PID:2144 -
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"121⤵PID:892
-
C:\WINDOWS\SysWOW64\SVCH0ST.EXE"C:\WINDOWS\SYSTEM32\SVCH0ST.EXE"122⤵PID:396
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-