Analysis
-
max time kernel
39s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-10-2022 18:42
Behavioral task
behavioral1
Sample
b8a9514036e06c218c044600d103b049ccdc131ed6638a5f52651ba687c815a7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b8a9514036e06c218c044600d103b049ccdc131ed6638a5f52651ba687c815a7.exe
Resource
win10v2004-20220812-en
General
-
Target
b8a9514036e06c218c044600d103b049ccdc131ed6638a5f52651ba687c815a7.exe
-
Size
106KB
-
MD5
83ee0340a0f10abc3b1d5ea766cfc360
-
SHA1
b00b9dceb9da25a6bcfacb71b247ff618eadcb18
-
SHA256
b8a9514036e06c218c044600d103b049ccdc131ed6638a5f52651ba687c815a7
-
SHA512
af083040ec106609f25f6e9b5862a76f280144b428c7c148c2cc9a9a1b61c0de92b30264eea2c12b2c4edef1fc6687f238c2c382c19c5e87304de632fc907b41
-
SSDEEP
1536:2mLKJ/GKrAQDIJugUZJv8TuK2KYwMDd0Xl8Qq28UNtuOFZQsQtgT:fLKJOKrAQDMTu3IyQq233ZNzT
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1048 EEbcvWs.exe 1508 EEbcvWs.exe 1308 EEbcvWs.exe 1748 EEbcvWs.exe 1968 EEbcvWs.exe 1724 EEbcvWs.exe 888 EEbcvWs.exe 1512 EEbcvWs.exe 1272 EEbcvWs.exe 824 EEbcvWs.exe 1052 EEbcvWs.exe 472 EEbcvWs.exe 1532 EEbcvWs.exe 956 EEbcvWs.exe 1140 EEbcvWs.exe 908 EEbcvWs.exe 944 EEbcvWs.exe 1936 EEbcvWs.exe 936 EEbcvWs.exe 1924 EEbcvWs.exe 1972 EEbcvWs.exe 1388 EEbcvWs.exe 1248 EEbcvWs.exe 1700 EEbcvWs.exe 1888 EEbcvWs.exe 396 EEbcvWs.exe 1688 EEbcvWs.exe 1828 EEbcvWs.exe 1680 EEbcvWs.exe 1948 EEbcvWs.exe 808 EEbcvWs.exe 580 EEbcvWs.exe 1944 EEbcvWs.exe 2044 EEbcvWs.exe 1592 EEbcvWs.exe 836 EEbcvWs.exe 556 EEbcvWs.exe 560 EEbcvWs.exe 1168 EEbcvWs.exe 1580 EEbcvWs.exe 1584 EEbcvWs.exe 1536 EEbcvWs.exe 1460 EEbcvWs.exe 752 EEbcvWs.exe 1588 EEbcvWs.exe 344 EEbcvWs.exe 456 EEbcvWs.exe 364 EEbcvWs.exe 552 EEbcvWs.exe 1068 EEbcvWs.exe 2020 EEbcvWs.exe 1784 EEbcvWs.exe 968 EEbcvWs.exe 1264 EEbcvWs.exe 2052 EEbcvWs.exe 2072 EEbcvWs.exe 2092 EEbcvWs.exe 2112 EEbcvWs.exe 2132 EEbcvWs.exe 2152 EEbcvWs.exe 2172 EEbcvWs.exe 2192 EEbcvWs.exe 2212 EEbcvWs.exe 2232 EEbcvWs.exe -
resource yara_rule behavioral1/memory/976-55-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/files/0x000a000000012303-56.dat upx behavioral1/files/0x000a000000012303-57.dat upx behavioral1/files/0x000a000000012303-59.dat upx behavioral1/files/0x000a000000012303-62.dat upx behavioral1/files/0x000a000000012303-63.dat upx behavioral1/files/0x000a000000012303-65.dat upx behavioral1/files/0x000a000000012303-61.dat upx behavioral1/files/0x000a000000012303-67.dat upx behavioral1/files/0x000a000000012303-68.dat upx behavioral1/files/0x000a000000012303-70.dat upx behavioral1/files/0x000a000000012303-73.dat upx behavioral1/files/0x000a000000012303-75.dat upx behavioral1/files/0x000a000000012303-72.dat upx behavioral1/files/0x000a000000012303-77.dat upx behavioral1/files/0x000a000000012303-78.dat upx behavioral1/files/0x000a000000012303-80.dat upx behavioral1/files/0x000a000000012303-82.dat upx behavioral1/files/0x000a000000012303-83.dat upx behavioral1/files/0x000a000000012303-85.dat upx behavioral1/files/0x000a000000012303-87.dat upx behavioral1/files/0x000a000000012303-88.dat upx behavioral1/files/0x000a000000012303-92.dat upx behavioral1/memory/1048-91-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1308-98-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/files/0x000a000000012303-96.dat upx behavioral1/files/0x000a000000012303-95.dat upx behavioral1/files/0x000a000000012303-99.dat upx behavioral1/memory/1508-94-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1968-102-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1748-101-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/files/0x000a000000012303-103.dat upx behavioral1/memory/1724-106-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/files/0x000a000000012303-107.dat upx behavioral1/files/0x000a000000012303-109.dat upx behavioral1/files/0x000a000000012303-112.dat upx behavioral1/files/0x000a000000012303-114.dat upx behavioral1/files/0x000a000000012303-110.dat upx behavioral1/files/0x000a000000012303-117.dat upx behavioral1/files/0x000a000000012303-122.dat upx behavioral1/files/0x000a000000012303-124.dat upx behavioral1/files/0x000a000000012303-127.dat upx behavioral1/files/0x000a000000012303-129.dat upx behavioral1/files/0x000a000000012303-125.dat upx behavioral1/files/0x000a000000012303-134.dat upx behavioral1/files/0x000a000000012303-139.dat upx behavioral1/files/0x000a000000012303-142.dat upx behavioral1/files/0x000a000000012303-145.dat upx behavioral1/files/0x000a000000012303-144.dat upx behavioral1/files/0x000a000000012303-149.dat upx behavioral1/files/0x000a000000012303-152.dat upx behavioral1/files/0x000a000000012303-154.dat upx behavioral1/files/0x000a000000012303-150.dat upx behavioral1/files/0x000a000000012303-147.dat upx behavioral1/files/0x000a000000012303-140.dat upx behavioral1/files/0x000a000000012303-137.dat upx behavioral1/files/0x000a000000012303-159.dat upx behavioral1/files/0x000a000000012303-167.dat upx behavioral1/files/0x000a000000012303-165.dat upx behavioral1/files/0x000a000000012303-164.dat upx behavioral1/files/0x000a000000012303-162.dat upx behavioral1/files/0x000a000000012303-160.dat upx behavioral1/files/0x000a000000012303-157.dat upx behavioral1/files/0x000a000000012303-155.dat upx -
Loads dropped DLL 64 IoCs
pid Process 976 b8a9514036e06c218c044600d103b049ccdc131ed6638a5f52651ba687c815a7.exe 976 b8a9514036e06c218c044600d103b049ccdc131ed6638a5f52651ba687c815a7.exe 1048 EEbcvWs.exe 1048 EEbcvWs.exe 1508 EEbcvWs.exe 1508 EEbcvWs.exe 1308 EEbcvWs.exe 1308 EEbcvWs.exe 1748 EEbcvWs.exe 1748 EEbcvWs.exe 1968 EEbcvWs.exe 1968 EEbcvWs.exe 1724 EEbcvWs.exe 1724 EEbcvWs.exe 888 EEbcvWs.exe 888 EEbcvWs.exe 1512 EEbcvWs.exe 1512 EEbcvWs.exe 1272 EEbcvWs.exe 1272 EEbcvWs.exe 824 EEbcvWs.exe 824 EEbcvWs.exe 1052 EEbcvWs.exe 1052 EEbcvWs.exe 472 EEbcvWs.exe 472 EEbcvWs.exe 1532 EEbcvWs.exe 1532 EEbcvWs.exe 956 EEbcvWs.exe 956 EEbcvWs.exe 1140 EEbcvWs.exe 1140 EEbcvWs.exe 908 EEbcvWs.exe 908 EEbcvWs.exe 944 EEbcvWs.exe 944 EEbcvWs.exe 1936 EEbcvWs.exe 1936 EEbcvWs.exe 936 EEbcvWs.exe 936 EEbcvWs.exe 1924 EEbcvWs.exe 1924 EEbcvWs.exe 1972 EEbcvWs.exe 1972 EEbcvWs.exe 1388 EEbcvWs.exe 1388 EEbcvWs.exe 1248 EEbcvWs.exe 1248 EEbcvWs.exe 1700 EEbcvWs.exe 1700 EEbcvWs.exe 1888 EEbcvWs.exe 1888 EEbcvWs.exe 396 EEbcvWs.exe 396 EEbcvWs.exe 1688 EEbcvWs.exe 1688 EEbcvWs.exe 1828 EEbcvWs.exe 1828 EEbcvWs.exe 1680 EEbcvWs.exe 1680 EEbcvWs.exe 1948 EEbcvWs.exe 1948 EEbcvWs.exe 808 EEbcvWs.exe 808 EEbcvWs.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\l: EEbcvWs.exe File opened (read-only) \??\e: EEbcvWs.exe File opened (read-only) \??\s: EEbcvWs.exe File opened (read-only) \??\x: EEbcvWs.exe File opened (read-only) \??\y: EEbcvWs.exe File opened (read-only) \??\h: EEbcvWs.exe File opened (read-only) \??\t: EEbcvWs.exe File opened (read-only) \??\f: b8a9514036e06c218c044600d103b049ccdc131ed6638a5f52651ba687c815a7.exe File opened (read-only) \??\z: EEbcvWs.exe File opened (read-only) \??\j: EEbcvWs.exe File opened (read-only) \??\e: EEbcvWs.exe File opened (read-only) \??\q: EEbcvWs.exe File opened (read-only) \??\t: EEbcvWs.exe File opened (read-only) \??\g: EEbcvWs.exe File opened (read-only) \??\u: EEbcvWs.exe File opened (read-only) \??\h: EEbcvWs.exe File opened (read-only) \??\i: EEbcvWs.exe File opened (read-only) \??\o: EEbcvWs.exe File opened (read-only) \??\f: EEbcvWs.exe File opened (read-only) \??\y: EEbcvWs.exe File opened (read-only) \??\t: EEbcvWs.exe File opened (read-only) \??\i: EEbcvWs.exe File opened (read-only) \??\w: EEbcvWs.exe File opened (read-only) \??\g: EEbcvWs.exe File opened (read-only) \??\h: EEbcvWs.exe File opened (read-only) \??\e: EEbcvWs.exe File opened (read-only) \??\p: EEbcvWs.exe File opened (read-only) \??\r: EEbcvWs.exe File opened (read-only) \??\x: Vc87pWX.exe File opened (read-only) \??\j: EEbcvWs.exe File opened (read-only) \??\z: EEbcvWs.exe File opened (read-only) \??\z: EEbcvWs.exe File opened (read-only) \??\u: EEbcvWs.exe File opened (read-only) \??\g: EEbcvWs.exe File opened (read-only) \??\p: EEbcvWs.exe File opened (read-only) \??\w: EEbcvWs.exe File opened (read-only) \??\w: EEbcvWs.exe File opened (read-only) \??\i: Vc87pWX.exe File opened (read-only) \??\k: EEbcvWs.exe File opened (read-only) \??\p: EEbcvWs.exe File opened (read-only) \??\p: EEbcvWs.exe File opened (read-only) \??\z: EEbcvWs.exe File opened (read-only) \??\k: EEbcvWs.exe File opened (read-only) \??\h: EEbcvWs.exe File opened (read-only) \??\n: EEbcvWs.exe File opened (read-only) \??\h: EEbcvWs.exe File opened (read-only) \??\i: EEbcvWs.exe File opened (read-only) \??\h: EEbcvWs.exe File opened (read-only) \??\v: EEbcvWs.exe File opened (read-only) \??\n: EEbcvWs.exe File opened (read-only) \??\o: EEbcvWs.exe File opened (read-only) \??\l: EEbcvWs.exe File opened (read-only) \??\o: EEbcvWs.exe File opened (read-only) \??\l: EEbcvWs.exe File opened (read-only) \??\f: EEbcvWs.exe File opened (read-only) \??\z: EEbcvWs.exe File opened (read-only) \??\f: EEbcvWs.exe File opened (read-only) \??\x: EEbcvWs.exe File opened (read-only) \??\g: EEbcvWs.exe File opened (read-only) \??\t: EEbcvWs.exe File opened (read-only) \??\v: EEbcvWs.exe File opened (read-only) \??\x: EEbcvWs.exe File opened (read-only) \??\o: EEbcvWs.exe File opened (read-only) \??\r: EEbcvWs.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe Vc87pWX.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe Vc87pWX.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe Vc87pWX.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 976 b8a9514036e06c218c044600d103b049ccdc131ed6638a5f52651ba687c815a7.exe Token: SeLoadDriverPrivilege 1048 EEbcvWs.exe Token: SeLoadDriverPrivilege 1508 EEbcvWs.exe Token: SeLoadDriverPrivilege 1308 EEbcvWs.exe Token: SeLoadDriverPrivilege 1748 EEbcvWs.exe Token: SeLoadDriverPrivilege 1968 EEbcvWs.exe Token: SeLoadDriverPrivilege 1724 EEbcvWs.exe Token: SeLoadDriverPrivilege 888 EEbcvWs.exe Token: SeLoadDriverPrivilege 1512 EEbcvWs.exe Token: SeLoadDriverPrivilege 1272 EEbcvWs.exe Token: SeLoadDriverPrivilege 824 EEbcvWs.exe Token: SeLoadDriverPrivilege 1052 EEbcvWs.exe Token: SeLoadDriverPrivilege 472 EEbcvWs.exe Token: SeLoadDriverPrivilege 1532 EEbcvWs.exe Token: SeLoadDriverPrivilege 956 EEbcvWs.exe Token: SeLoadDriverPrivilege 1140 EEbcvWs.exe Token: SeLoadDriverPrivilege 908 EEbcvWs.exe Token: SeLoadDriverPrivilege 944 EEbcvWs.exe Token: SeLoadDriverPrivilege 1936 EEbcvWs.exe Token: SeLoadDriverPrivilege 936 EEbcvWs.exe Token: SeLoadDriverPrivilege 1924 EEbcvWs.exe Token: SeLoadDriverPrivilege 1972 EEbcvWs.exe Token: SeLoadDriverPrivilege 1388 EEbcvWs.exe Token: SeLoadDriverPrivilege 1248 EEbcvWs.exe Token: SeLoadDriverPrivilege 1700 EEbcvWs.exe Token: SeLoadDriverPrivilege 1888 EEbcvWs.exe Token: SeLoadDriverPrivilege 396 EEbcvWs.exe Token: SeLoadDriverPrivilege 1688 EEbcvWs.exe Token: SeLoadDriverPrivilege 1828 EEbcvWs.exe Token: SeLoadDriverPrivilege 1680 EEbcvWs.exe Token: SeLoadDriverPrivilege 1948 EEbcvWs.exe Token: SeLoadDriverPrivilege 808 EEbcvWs.exe Token: SeLoadDriverPrivilege 580 EEbcvWs.exe Token: SeLoadDriverPrivilege 1944 EEbcvWs.exe Token: SeLoadDriverPrivilege 2044 EEbcvWs.exe Token: SeLoadDriverPrivilege 1592 EEbcvWs.exe Token: SeLoadDriverPrivilege 836 EEbcvWs.exe Token: SeLoadDriverPrivilege 556 EEbcvWs.exe Token: SeLoadDriverPrivilege 560 EEbcvWs.exe Token: SeLoadDriverPrivilege 1168 EEbcvWs.exe Token: SeLoadDriverPrivilege 1580 EEbcvWs.exe Token: SeLoadDriverPrivilege 1584 EEbcvWs.exe Token: SeLoadDriverPrivilege 1536 EEbcvWs.exe Token: SeLoadDriverPrivilege 1460 EEbcvWs.exe Token: SeLoadDriverPrivilege 752 EEbcvWs.exe Token: SeLoadDriverPrivilege 1588 EEbcvWs.exe Token: SeLoadDriverPrivilege 344 EEbcvWs.exe Token: SeLoadDriverPrivilege 456 EEbcvWs.exe Token: SeLoadDriverPrivilege 364 EEbcvWs.exe Token: SeLoadDriverPrivilege 552 EEbcvWs.exe Token: SeLoadDriverPrivilege 1068 EEbcvWs.exe Token: SeLoadDriverPrivilege 2020 EEbcvWs.exe Token: SeLoadDriverPrivilege 1784 EEbcvWs.exe Token: SeLoadDriverPrivilege 968 EEbcvWs.exe Token: SeLoadDriverPrivilege 1264 EEbcvWs.exe Token: SeLoadDriverPrivilege 2052 EEbcvWs.exe Token: SeLoadDriverPrivilege 2072 EEbcvWs.exe Token: SeLoadDriverPrivilege 2092 EEbcvWs.exe Token: SeLoadDriverPrivilege 2112 EEbcvWs.exe Token: SeLoadDriverPrivilege 2132 EEbcvWs.exe Token: SeLoadDriverPrivilege 2152 EEbcvWs.exe Token: SeLoadDriverPrivilege 2172 EEbcvWs.exe Token: SeLoadDriverPrivilege 2192 EEbcvWs.exe Token: SeLoadDriverPrivilege 2212 EEbcvWs.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 976 wrote to memory of 1048 976 b8a9514036e06c218c044600d103b049ccdc131ed6638a5f52651ba687c815a7.exe 27 PID 976 wrote to memory of 1048 976 b8a9514036e06c218c044600d103b049ccdc131ed6638a5f52651ba687c815a7.exe 27 PID 976 wrote to memory of 1048 976 b8a9514036e06c218c044600d103b049ccdc131ed6638a5f52651ba687c815a7.exe 27 PID 976 wrote to memory of 1048 976 b8a9514036e06c218c044600d103b049ccdc131ed6638a5f52651ba687c815a7.exe 27 PID 1048 wrote to memory of 1508 1048 EEbcvWs.exe 28 PID 1048 wrote to memory of 1508 1048 EEbcvWs.exe 28 PID 1048 wrote to memory of 1508 1048 EEbcvWs.exe 28 PID 1048 wrote to memory of 1508 1048 EEbcvWs.exe 28 PID 1508 wrote to memory of 1308 1508 EEbcvWs.exe 29 PID 1508 wrote to memory of 1308 1508 EEbcvWs.exe 29 PID 1508 wrote to memory of 1308 1508 EEbcvWs.exe 29 PID 1508 wrote to memory of 1308 1508 EEbcvWs.exe 29 PID 1308 wrote to memory of 1748 1308 EEbcvWs.exe 30 PID 1308 wrote to memory of 1748 1308 EEbcvWs.exe 30 PID 1308 wrote to memory of 1748 1308 EEbcvWs.exe 30 PID 1308 wrote to memory of 1748 1308 EEbcvWs.exe 30 PID 1748 wrote to memory of 1968 1748 EEbcvWs.exe 31 PID 1748 wrote to memory of 1968 1748 EEbcvWs.exe 31 PID 1748 wrote to memory of 1968 1748 EEbcvWs.exe 31 PID 1748 wrote to memory of 1968 1748 EEbcvWs.exe 31 PID 1968 wrote to memory of 1724 1968 EEbcvWs.exe 32 PID 1968 wrote to memory of 1724 1968 EEbcvWs.exe 32 PID 1968 wrote to memory of 1724 1968 EEbcvWs.exe 32 PID 1968 wrote to memory of 1724 1968 EEbcvWs.exe 32 PID 1724 wrote to memory of 888 1724 EEbcvWs.exe 33 PID 1724 wrote to memory of 888 1724 EEbcvWs.exe 33 PID 1724 wrote to memory of 888 1724 EEbcvWs.exe 33 PID 1724 wrote to memory of 888 1724 EEbcvWs.exe 33 PID 888 wrote to memory of 1512 888 EEbcvWs.exe 34 PID 888 wrote to memory of 1512 888 EEbcvWs.exe 34 PID 888 wrote to memory of 1512 888 EEbcvWs.exe 34 PID 888 wrote to memory of 1512 888 EEbcvWs.exe 34 PID 1512 wrote to memory of 1272 1512 EEbcvWs.exe 35 PID 1512 wrote to memory of 1272 1512 EEbcvWs.exe 35 PID 1512 wrote to memory of 1272 1512 EEbcvWs.exe 35 PID 1512 wrote to memory of 1272 1512 EEbcvWs.exe 35 PID 1272 wrote to memory of 824 1272 EEbcvWs.exe 57 PID 1272 wrote to memory of 824 1272 EEbcvWs.exe 57 PID 1272 wrote to memory of 824 1272 EEbcvWs.exe 57 PID 1272 wrote to memory of 824 1272 EEbcvWs.exe 57 PID 824 wrote to memory of 1052 824 EEbcvWs.exe 36 PID 824 wrote to memory of 1052 824 EEbcvWs.exe 36 PID 824 wrote to memory of 1052 824 EEbcvWs.exe 36 PID 824 wrote to memory of 1052 824 EEbcvWs.exe 36 PID 1052 wrote to memory of 472 1052 EEbcvWs.exe 56 PID 1052 wrote to memory of 472 1052 EEbcvWs.exe 56 PID 1052 wrote to memory of 472 1052 EEbcvWs.exe 56 PID 1052 wrote to memory of 472 1052 EEbcvWs.exe 56 PID 472 wrote to memory of 1532 472 EEbcvWs.exe 38 PID 472 wrote to memory of 1532 472 EEbcvWs.exe 38 PID 472 wrote to memory of 1532 472 EEbcvWs.exe 38 PID 472 wrote to memory of 1532 472 EEbcvWs.exe 38 PID 1532 wrote to memory of 956 1532 EEbcvWs.exe 37 PID 1532 wrote to memory of 956 1532 EEbcvWs.exe 37 PID 1532 wrote to memory of 956 1532 EEbcvWs.exe 37 PID 1532 wrote to memory of 956 1532 EEbcvWs.exe 37 PID 956 wrote to memory of 1140 956 EEbcvWs.exe 55 PID 956 wrote to memory of 1140 956 EEbcvWs.exe 55 PID 956 wrote to memory of 1140 956 EEbcvWs.exe 55 PID 956 wrote to memory of 1140 956 EEbcvWs.exe 55 PID 1140 wrote to memory of 908 1140 EEbcvWs.exe 39 PID 1140 wrote to memory of 908 1140 EEbcvWs.exe 39 PID 1140 wrote to memory of 908 1140 EEbcvWs.exe 39 PID 1140 wrote to memory of 908 1140 EEbcvWs.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8a9514036e06c218c044600d103b049ccdc131ed6638a5f52651ba687c815a7.exe"C:\Users\Admin\AppData\Local\Temp\b8a9514036e06c218c044600d103b049ccdc131ed6638a5f52651ba687c815a7.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe12⤵PID:5076
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe13⤵PID:5532
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe14⤵PID:9352
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe11⤵PID:5056
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe12⤵PID:5844
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe13⤵PID:9708
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe10⤵
- Enumerates connected drives
PID:5048 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe11⤵PID:5472
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe12⤵PID:9220
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe9⤵PID:5028
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe10⤵PID:5752
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe11⤵PID:9452
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe8⤵PID:4996
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe9⤵PID:5604
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe10⤵PID:9244
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe7⤵PID:4960
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe8⤵PID:5760
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe9⤵PID:9328
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe6⤵
- Drops file in System32 directory
PID:4912 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe7⤵PID:5324
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe8⤵PID:5888
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe9⤵PID:9404
-
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe5⤵
- Enumerates connected drives
PID:4864 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe6⤵PID:5332
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe7⤵PID:5868
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe8⤵PID:9540
-
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe4⤵PID:4804
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe5⤵PID:5252
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe6⤵PID:5792
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe7⤵PID:752
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe5⤵PID:9344
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe3⤵
- Drops file in System32 directory
PID:4768 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe4⤵PID:5308
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe5⤵PID:5820
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe6⤵PID:9724
-
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe2⤵PID:4748
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe3⤵PID:5260
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe4⤵PID:5808
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe5⤵PID:9236
-
-
-
-
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe3⤵PID:5096
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe4⤵PID:5524
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe5⤵PID:9360
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe2⤵PID:5084
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe3⤵PID:5936
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe4⤵PID:8568
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe5⤵PID:6136
-
-
-
-
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe3⤵PID:4180
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe4⤵PID:5980
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe5⤵PID:8472
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe6⤵PID:6204
-
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe2⤵
- Drops file in System32 directory
PID:4148 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe3⤵PID:5516
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe4⤵PID:9436
-
-
-
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe2⤵PID:5112
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe3⤵PID:5928
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe4⤵PID:8560
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe3⤵PID:5960
-
-
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:908 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:944 -
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe3⤵PID:4308
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe4⤵PID:5972
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe5⤵PID:8488
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe2⤵PID:4228
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe3⤵PID:5444
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe4⤵PID:9532
-
-
-
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:936 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1924 -
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe3⤵PID:4484
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe4⤵PID:5388
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe5⤵PID:8496
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe6⤵PID:6216
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe4⤵PID:1112
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe2⤵PID:4452
-
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1936 -
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe2⤵PID:4372
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe3⤵PID:5396
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe4⤵PID:8448
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe5⤵PID:6112
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe3⤵PID:9468
-
-
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1388 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1248 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1700 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1888 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:396 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1688 -
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe7⤵PID:5172
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe8⤵PID:5772
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe9⤵PID:2044
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe6⤵PID:5164
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe7⤵PID:5656
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe8⤵PID:4404
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe5⤵PID:5156
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe6⤵PID:6040
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe7⤵PID:8908
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe4⤵PID:5148
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe5⤵PID:5664
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe6⤵PID:1552
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe3⤵PID:5128
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe4⤵PID:6016
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe5⤵PID:8660
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe2⤵PID:4948
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe3⤵PID:5680
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe4⤵PID:9580
-
-
-
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1828 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1680 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1948 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:808 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:580 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1944 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2044 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1592 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:836 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:556 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe11⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:560 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1168 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe13⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1580 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1584 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1536 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1460 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:752 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1588 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:344 -
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe20⤵PID:6028
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe21⤵PID:4212
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe19⤵PID:5988
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe20⤵PID:8504
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe21⤵PID:6208
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe18⤵PID:5948
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe17⤵PID:5880
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe16⤵PID:5860
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe15⤵PID:5744
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe16⤵PID:6060
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe14⤵PID:5732
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe13⤵PID:5648
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe14⤵PID:8456
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe15⤵PID:6164
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe12⤵PID:5620
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe11⤵PID:5568
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe12⤵PID:8804
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe10⤵PID:5496
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe11⤵PID:1124
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe9⤵PID:5408
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe10⤵PID:8480
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe11⤵PID:6268
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe8⤵PID:5420
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe9⤵PID:8464
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe10⤵PID:10048
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe7⤵PID:5344
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe8⤵PID:4892
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe6⤵PID:5280
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe7⤵PID:5900
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe8⤵PID:1816
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe5⤵PID:5220
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe6⤵PID:8372
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe7⤵PID:6120
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe4⤵PID:5228
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe5⤵PID:5556
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe6⤵PID:8680
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe5⤵PID:10104
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe3⤵PID:5188
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe4⤵PID:5708
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe5⤵PID:8956
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe4⤵PID:10232
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe2⤵PID:5180
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe3⤵PID:5584
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe4⤵PID:5352
-
-
-
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1972 -
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe2⤵PID:4516
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe3⤵PID:6000
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe4⤵PID:4856
-
-
-
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:456 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:364 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:552 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1068 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2020 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1784 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:968 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1264 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe9⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2052 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2072 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2092 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2112 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2132 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe14⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2152 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2172 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2192 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2212 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe18⤵
- Executes dropped EXE
PID:2232 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe19⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:2252 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe20⤵PID:2268
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe21⤵PID:2284
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe22⤵PID:2300
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe23⤵PID:2316
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe24⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:2332 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe25⤵PID:2348
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe26⤵PID:2364
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe27⤵PID:2380
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe28⤵
- Drops file in System32 directory
PID:2396 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe29⤵PID:2412
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe30⤵PID:2428
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe31⤵PID:2444
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe32⤵
- Drops file in System32 directory
PID:2460 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe33⤵
- Drops file in System32 directory
PID:2476 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe34⤵
- Enumerates connected drives
PID:2492 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe35⤵PID:2508
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe36⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:2528 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe37⤵
- Drops file in System32 directory
PID:2556 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe38⤵PID:2584
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe39⤵
- Drops file in System32 directory
PID:2608 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe40⤵PID:2640
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe41⤵PID:2668
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe42⤵PID:2692
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe43⤵PID:2720
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe44⤵
- Drops file in System32 directory
PID:2752 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe45⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:2784 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe46⤵PID:2808
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe47⤵PID:2836
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe48⤵PID:2864
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe49⤵PID:2900
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe50⤵
- Enumerates connected drives
PID:2924 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe51⤵
- Enumerates connected drives
PID:2952 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe52⤵PID:2976
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe53⤵PID:3004
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe54⤵PID:3024
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe55⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:3052 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe56⤵PID:2084
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe57⤵PID:2164
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe58⤵
- Drops file in System32 directory
PID:2244 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe59⤵
- Drops file in System32 directory
PID:2340 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe60⤵PID:2452
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe61⤵PID:2536
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe62⤵PID:2592
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe63⤵PID:2632
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe64⤵
- Drops file in System32 directory
PID:2700 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe65⤵PID:2740
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe66⤵PID:2776
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe67⤵PID:2824
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe68⤵PID:2876
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe69⤵
- Enumerates connected drives
PID:2916 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe70⤵PID:2968
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe71⤵PID:3032
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe72⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:2064 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe73⤵PID:2160
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe74⤵PID:2292
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe75⤵PID:2484
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe76⤵PID:2620
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe77⤵
- Enumerates connected drives
PID:2716 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe78⤵
- Enumerates connected drives
PID:2816 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe79⤵
- Drops file in System32 directory
PID:2912 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe80⤵PID:2988
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe81⤵
- Enumerates connected drives
PID:2104 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe82⤵
- Drops file in System32 directory
PID:2224 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe83⤵
- Enumerates connected drives
PID:2564 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe84⤵
- Enumerates connected drives
PID:2664 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe85⤵PID:2768
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe86⤵PID:2896
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe87⤵PID:3064
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe88⤵
- Enumerates connected drives
PID:2544 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe89⤵PID:2760
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe90⤵
- Enumerates connected drives
PID:3036 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe91⤵PID:2652
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe92⤵PID:2372
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe93⤵PID:2948
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe94⤵
- Drops file in System32 directory
PID:3076 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe95⤵
- Enumerates connected drives
PID:3092 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe96⤵PID:3108
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe97⤵PID:3124
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe98⤵PID:3140
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe99⤵PID:3156
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe100⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:3172 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe101⤵
- Enumerates connected drives
PID:3188 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe102⤵PID:3204
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe103⤵PID:3220
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe104⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:3236 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe105⤵PID:3252
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe106⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:3268 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe107⤵PID:3284
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe108⤵PID:3300
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe109⤵PID:3316
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe110⤵
- Drops file in System32 directory
PID:3332 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe111⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:3348 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe112⤵
- Drops file in System32 directory
PID:3364 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe113⤵PID:3380
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe114⤵PID:3396
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe115⤵PID:3412
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe116⤵
- Drops file in System32 directory
PID:3428 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe117⤵PID:3444
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe118⤵PID:3472
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe119⤵
- Enumerates connected drives
PID:3500 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe120⤵PID:3524
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe121⤵
- Enumerates connected drives
PID:3552 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe122⤵PID:3576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-