c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae

Analysis

max time kernel
138s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 17:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
Size

42KB
MD5

0054e515274d63fd51d1d88a001c18b0
SHA1

dfa952019b51f3b419562c836c64768409eaeb5a
SHA256

c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae
SHA512

58298d5aedbec181e8f66f7d20de6c9893d002891bc2349a201a4b8e74c204be64f0918d7f7ec90fff4321fc809344d920a455f3fd6085563ab11f19d95d5134
SSDEEP

768:Z0mwxXA7N3ISOrPs1chtUHoiHaxWtg0rEhQA91md8sbWooUKOk:Zr8lSaExISax8SQA98d8swUBk

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 608	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	6
PID 1356 wrote to memory of 608	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	6
PID 1356 wrote to memory of 608	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	6
PID 1356 wrote to memory of 608	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	6
PID 1356 wrote to memory of 608	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	6
PID 1356 wrote to memory of 608	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	6
PID 1356 wrote to memory of 660	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	4
PID 1356 wrote to memory of 660	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	4
PID 1356 wrote to memory of 660	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	4
PID 1356 wrote to memory of 660	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	4
PID 1356 wrote to memory of 660	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	4
PID 1356 wrote to memory of 660	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	4
PID 1356 wrote to memory of 768	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	8
PID 1356 wrote to memory of 768	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	8
PID 1356 wrote to memory of 768	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	8
PID 1356 wrote to memory of 768	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	8
PID 1356 wrote to memory of 768	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	8
PID 1356 wrote to memory of 768	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	8
PID 1356 wrote to memory of 776	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	78
PID 1356 wrote to memory of 776	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	78
PID 1356 wrote to memory of 776	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	78
PID 1356 wrote to memory of 776	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	78
PID 1356 wrote to memory of 776	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	78
PID 1356 wrote to memory of 776	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	78
PID 1356 wrote to memory of 784	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	77
PID 1356 wrote to memory of 784	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	77
PID 1356 wrote to memory of 784	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	77
PID 1356 wrote to memory of 784	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	77
PID 1356 wrote to memory of 784	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	77
PID 1356 wrote to memory of 784	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	77
PID 1356 wrote to memory of 892	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	76
PID 1356 wrote to memory of 892	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	76
PID 1356 wrote to memory of 892	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	76
PID 1356 wrote to memory of 892	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	76
PID 1356 wrote to memory of 892	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	76
PID 1356 wrote to memory of 892	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	76
PID 1356 wrote to memory of 944	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	75
PID 1356 wrote to memory of 944	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	75
PID 1356 wrote to memory of 944	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	75
PID 1356 wrote to memory of 944	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	75
PID 1356 wrote to memory of 944	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	75
PID 1356 wrote to memory of 944	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	75
PID 1356 wrote to memory of 312	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	9
PID 1356 wrote to memory of 312	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	9
PID 1356 wrote to memory of 312	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	9
PID 1356 wrote to memory of 312	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	9
PID 1356 wrote to memory of 312	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	9
PID 1356 wrote to memory of 312	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	9
PID 1356 wrote to memory of 532	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	10
PID 1356 wrote to memory of 532	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	10
PID 1356 wrote to memory of 532	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	10
PID 1356 wrote to memory of 532	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	10
PID 1356 wrote to memory of 532	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	10
PID 1356 wrote to memory of 532	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	10
PID 1356 wrote to memory of 740	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	74
PID 1356 wrote to memory of 740	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	74
PID 1356 wrote to memory of 740	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	74
PID 1356 wrote to memory of 740	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	74
PID 1356 wrote to memory of 740	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	74
PID 1356 wrote to memory of 740	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	74
PID 1356 wrote to memory of 908	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	73
PID 1356 wrote to memory of 908	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	73
PID 1356 wrote to memory of 908	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	73
PID 1356 wrote to memory of 908	1356	c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe	73

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:660

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:608
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:312
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:768
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:5032
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:4496
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4776
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3896
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3544
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3464
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3412
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3348
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3244
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:1992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1036
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1176

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:3784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4432

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:760

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2432
- C:\Users\Admin\AppData\Local\Temp\c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe
  "C:\Users\Admin\AppData\Local\Temp\c5e31a1d2594b268116d86338b8dd0989400457efa39632b5bd8d283929793ae.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2640

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2388

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2376

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2132

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1364

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1480

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1232

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:892

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1356-132-0x0000000001000000-0x0000000001019000-memory.dmp

Filesize
100KB

Download