Analysis
-
max time kernel
40s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-10-2022 18:42
Behavioral task
behavioral1
Sample
b8a9514036e06c218c044600d103b049ccdc131ed6638a5f52651ba687c815a7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b8a9514036e06c218c044600d103b049ccdc131ed6638a5f52651ba687c815a7.exe
Resource
win10v2004-20220812-en
General
-
Target
b8a9514036e06c218c044600d103b049ccdc131ed6638a5f52651ba687c815a7.exe
-
Size
106KB
-
MD5
83ee0340a0f10abc3b1d5ea766cfc360
-
SHA1
b00b9dceb9da25a6bcfacb71b247ff618eadcb18
-
SHA256
b8a9514036e06c218c044600d103b049ccdc131ed6638a5f52651ba687c815a7
-
SHA512
af083040ec106609f25f6e9b5862a76f280144b428c7c148c2cc9a9a1b61c0de92b30264eea2c12b2c4edef1fc6687f238c2c382c19c5e87304de632fc907b41
-
SSDEEP
1536:2mLKJ/GKrAQDIJugUZJv8TuK2KYwMDd0Xl8Qq28UNtuOFZQsQtgT:fLKJOKrAQDMTu3IyQq233ZNzT
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4360 EEbcvWs.exe 4392 EEbcvWs.exe 4660 EEbcvWs.exe 1644 EEbcvWs.exe 820 EEbcvWs.exe 1516 EEbcvWs.exe 1836 EEbcvWs.exe 2480 EEbcvWs.exe 4716 EEbcvWs.exe 2652 EEbcvWs.exe 1252 EEbcvWs.exe 3480 EEbcvWs.exe 308 EEbcvWs.exe 228 EEbcvWs.exe 3532 EEbcvWs.exe 1108 EEbcvWs.exe 2044 EEbcvWs.exe 4228 EEbcvWs.exe 3820 EEbcvWs.exe 3868 EEbcvWs.exe 2936 EEbcvWs.exe 3136 EEbcvWs.exe 1344 EEbcvWs.exe 4276 EEbcvWs.exe 4880 EEbcvWs.exe 4116 EEbcvWs.exe 4468 EEbcvWs.exe 4464 EEbcvWs.exe 3720 EEbcvWs.exe 1468 EEbcvWs.exe 2368 EEbcvWs.exe 3044 EEbcvWs.exe 796 EEbcvWs.exe 424 EEbcvWs.exe 2760 EEbcvWs.exe 1612 EEbcvWs.exe 2296 EEbcvWs.exe 2836 EEbcvWs.exe 2792 EEbcvWs.exe 4772 EEbcvWs.exe 2780 EEbcvWs.exe 2588 EEbcvWs.exe 2404 EEbcvWs.exe 3904 EEbcvWs.exe 1044 EEbcvWs.exe 2324 EEbcvWs.exe 4280 EEbcvWs.exe 4992 EEbcvWs.exe 4136 EEbcvWs.exe 4724 EEbcvWs.exe 764 EEbcvWs.exe 4340 EEbcvWs.exe 3288 EEbcvWs.exe 1944 EEbcvWs.exe 1124 EEbcvWs.exe 3992 EEbcvWs.exe 5052 EEbcvWs.exe 2088 EEbcvWs.exe 4940 EEbcvWs.exe 4048 EEbcvWs.exe 520 EEbcvWs.exe 2816 EEbcvWs.exe 2712 EEbcvWs.exe 1928 EEbcvWs.exe -
resource yara_rule behavioral2/memory/768-132-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/files/0x000a000000022e3e-134.dat upx behavioral2/files/0x000a000000022e3e-135.dat upx behavioral2/files/0x000a000000022e3e-137.dat upx behavioral2/files/0x000a000000022e3e-139.dat upx behavioral2/files/0x000a000000022e3e-141.dat upx behavioral2/files/0x000a000000022e3e-143.dat upx behavioral2/files/0x000a000000022e3e-145.dat upx behavioral2/files/0x000a000000022e3e-147.dat upx behavioral2/files/0x000a000000022e3e-149.dat upx behavioral2/files/0x000a000000022e3e-151.dat upx behavioral2/files/0x000a000000022e3e-153.dat upx behavioral2/memory/4360-154-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4392-156-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4660-158-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/files/0x000a000000022e3e-157.dat upx behavioral2/memory/1644-160-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/files/0x000a000000022e3e-161.dat upx behavioral2/memory/820-163-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/files/0x000a000000022e3e-164.dat upx behavioral2/memory/1516-165-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4716-170-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/files/0x000a000000022e3e-169.dat upx behavioral2/memory/2480-168-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/1836-166-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2652-172-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/files/0x000a000000022e3e-173.dat upx behavioral2/files/0x000a000000022e3e-175.dat upx behavioral2/files/0x000a000000022e3e-177.dat upx behavioral2/files/0x000a000000022e3e-179.dat upx behavioral2/files/0x000a000000022e3e-181.dat upx behavioral2/files/0x000a000000022e3e-183.dat upx behavioral2/files/0x000a000000022e3e-185.dat upx behavioral2/files/0x000a000000022e3e-187.dat upx behavioral2/files/0x000a000000022e3e-189.dat upx behavioral2/files/0x000a000000022e3e-191.dat upx behavioral2/files/0x000a000000022e3e-193.dat upx behavioral2/files/0x000a000000022e3e-195.dat upx behavioral2/files/0x000a000000022e3e-197.dat upx behavioral2/files/0x000a000000022e3e-199.dat upx behavioral2/files/0x000a000000022e3e-201.dat upx behavioral2/memory/1252-203-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/files/0x000a000000022e3e-205.dat upx behavioral2/memory/308-207-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3480-204-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3532-211-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/files/0x000a000000022e3e-216.dat upx behavioral2/files/0x000a000000022e3e-221.dat upx behavioral2/memory/3868-220-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4228-217-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3820-219-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2044-215-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/1108-213-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/files/0x000a000000022e3e-212.dat upx behavioral2/memory/228-209-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/files/0x000a000000022e3e-208.dat upx behavioral2/memory/1344-225-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/files/0x000a000000022e3e-229.dat upx behavioral2/memory/4116-232-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4276-228-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/files/0x000a000000022e3e-226.dat upx behavioral2/memory/3136-224-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2936-222-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/files/0x000a000000022e3e-234.dat upx -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\n: EEbcvWs.exe File opened (read-only) \??\g: EEbcvWs.exe File opened (read-only) \??\t: EEbcvWs.exe File opened (read-only) \??\t: EEbcvWs.exe File opened (read-only) \??\f: EEbcvWs.exe File opened (read-only) \??\n: EEbcvWs.exe File opened (read-only) \??\o: EEbcvWs.exe File opened (read-only) \??\n: EEbcvWs.exe File opened (read-only) \??\j: EEbcvWs.exe File opened (read-only) \??\r: EEbcvWs.exe File opened (read-only) \??\j: EEbcvWs.exe File opened (read-only) \??\e: EEbcvWs.exe File opened (read-only) \??\y: EEbcvWs.exe File opened (read-only) \??\r: EEbcvWs.exe File opened (read-only) \??\s: EEbcvWs.exe File opened (read-only) \??\h: EEbcvWs.exe File opened (read-only) \??\e: EEbcvWs.exe File opened (read-only) \??\h: EEbcvWs.exe File opened (read-only) \??\i: EEbcvWs.exe File opened (read-only) \??\j: EEbcvWs.exe File opened (read-only) \??\m: EEbcvWs.exe File opened (read-only) \??\m: EEbcvWs.exe File opened (read-only) \??\u: EEbcvWs.exe File opened (read-only) \??\j: EEbcvWs.exe File opened (read-only) \??\r: EEbcvWs.exe File opened (read-only) \??\g: EEbcvWs.exe File opened (read-only) \??\n: EEbcvWs.exe File opened (read-only) \??\j: EEbcvWs.exe File opened (read-only) \??\n: EEbcvWs.exe File opened (read-only) \??\u: EEbcvWs.exe File opened (read-only) \??\e: EEbcvWs.exe File opened (read-only) \??\e: EEbcvWs.exe File opened (read-only) \??\w: EEbcvWs.exe File opened (read-only) \??\j: EEbcvWs.exe File opened (read-only) \??\p: EEbcvWs.exe File opened (read-only) \??\v: EEbcvWs.exe File opened (read-only) \??\u: EEbcvWs.exe File opened (read-only) \??\u: EEbcvWs.exe File opened (read-only) \??\i: EEbcvWs.exe File opened (read-only) \??\v: EEbcvWs.exe File opened (read-only) \??\l: EEbcvWs.exe File opened (read-only) \??\l: EEbcvWs.exe File opened (read-only) \??\x: EEbcvWs.exe File opened (read-only) \??\u: EEbcvWs.exe File opened (read-only) \??\y: EEbcvWs.exe File opened (read-only) \??\j: EEbcvWs.exe File opened (read-only) \??\y: EEbcvWs.exe File opened (read-only) \??\y: EEbcvWs.exe File opened (read-only) \??\z: EEbcvWs.exe File opened (read-only) \??\w: EEbcvWs.exe File opened (read-only) \??\q: EEbcvWs.exe File opened (read-only) \??\i: EEbcvWs.exe File opened (read-only) \??\u: EEbcvWs.exe File opened (read-only) \??\e: EEbcvWs.exe File opened (read-only) \??\i: EEbcvWs.exe File opened (read-only) \??\x: EEbcvWs.exe File opened (read-only) \??\h: EEbcvWs.exe File opened (read-only) \??\s: EEbcvWs.exe File opened (read-only) \??\g: EEbcvWs.exe File opened (read-only) \??\v: EEbcvWs.exe File opened (read-only) \??\o: EEbcvWs.exe File opened (read-only) \??\u: EEbcvWs.exe File opened (read-only) \??\o: EEbcvWs.exe File opened (read-only) \??\i: EEbcvWs.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe File created C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exe EEbcvWs.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 768 b8a9514036e06c218c044600d103b049ccdc131ed6638a5f52651ba687c815a7.exe Token: SeLoadDriverPrivilege 4360 EEbcvWs.exe Token: SeLoadDriverPrivilege 4392 EEbcvWs.exe Token: SeLoadDriverPrivilege 4660 EEbcvWs.exe Token: SeLoadDriverPrivilege 1644 EEbcvWs.exe Token: SeLoadDriverPrivilege 820 EEbcvWs.exe Token: SeLoadDriverPrivilege 1516 EEbcvWs.exe Token: SeLoadDriverPrivilege 1836 EEbcvWs.exe Token: SeLoadDriverPrivilege 2480 EEbcvWs.exe Token: SeLoadDriverPrivilege 4716 EEbcvWs.exe Token: SeLoadDriverPrivilege 2652 EEbcvWs.exe Token: SeLoadDriverPrivilege 1252 EEbcvWs.exe Token: SeLoadDriverPrivilege 3480 EEbcvWs.exe Token: SeLoadDriverPrivilege 308 EEbcvWs.exe Token: SeLoadDriverPrivilege 228 EEbcvWs.exe Token: SeLoadDriverPrivilege 3532 EEbcvWs.exe Token: SeLoadDriverPrivilege 1108 EEbcvWs.exe Token: SeLoadDriverPrivilege 2044 EEbcvWs.exe Token: SeLoadDriverPrivilege 4228 EEbcvWs.exe Token: SeLoadDriverPrivilege 3820 EEbcvWs.exe Token: SeLoadDriverPrivilege 3868 EEbcvWs.exe Token: SeLoadDriverPrivilege 2936 EEbcvWs.exe Token: SeLoadDriverPrivilege 3136 EEbcvWs.exe Token: SeLoadDriverPrivilege 1344 EEbcvWs.exe Token: SeLoadDriverPrivilege 4276 EEbcvWs.exe Token: SeLoadDriverPrivilege 4880 EEbcvWs.exe Token: SeLoadDriverPrivilege 4116 EEbcvWs.exe Token: SeLoadDriverPrivilege 4468 EEbcvWs.exe Token: SeLoadDriverPrivilege 4464 EEbcvWs.exe Token: SeLoadDriverPrivilege 3720 EEbcvWs.exe Token: SeLoadDriverPrivilege 1468 EEbcvWs.exe Token: SeLoadDriverPrivilege 2368 EEbcvWs.exe Token: SeLoadDriverPrivilege 3044 EEbcvWs.exe Token: SeLoadDriverPrivilege 796 EEbcvWs.exe Token: SeLoadDriverPrivilege 424 EEbcvWs.exe Token: SeLoadDriverPrivilege 2760 EEbcvWs.exe Token: SeLoadDriverPrivilege 1612 EEbcvWs.exe Token: SeLoadDriverPrivilege 2296 EEbcvWs.exe Token: SeLoadDriverPrivilege 2836 EEbcvWs.exe Token: SeLoadDriverPrivilege 2792 EEbcvWs.exe Token: SeLoadDriverPrivilege 4772 EEbcvWs.exe Token: SeLoadDriverPrivilege 2780 EEbcvWs.exe Token: SeLoadDriverPrivilege 2588 EEbcvWs.exe Token: SeLoadDriverPrivilege 2404 EEbcvWs.exe Token: SeLoadDriverPrivilege 3904 EEbcvWs.exe Token: SeLoadDriverPrivilege 1044 EEbcvWs.exe Token: SeLoadDriverPrivilege 2324 EEbcvWs.exe Token: SeLoadDriverPrivilege 4280 EEbcvWs.exe Token: SeLoadDriverPrivilege 4992 EEbcvWs.exe Token: SeLoadDriverPrivilege 4136 EEbcvWs.exe Token: SeLoadDriverPrivilege 4724 EEbcvWs.exe Token: SeLoadDriverPrivilege 764 EEbcvWs.exe Token: SeLoadDriverPrivilege 4340 EEbcvWs.exe Token: SeLoadDriverPrivilege 3288 EEbcvWs.exe Token: SeLoadDriverPrivilege 1944 EEbcvWs.exe Token: SeLoadDriverPrivilege 1124 EEbcvWs.exe Token: SeLoadDriverPrivilege 3992 EEbcvWs.exe Token: SeLoadDriverPrivilege 5052 EEbcvWs.exe Token: SeLoadDriverPrivilege 2088 EEbcvWs.exe Token: SeLoadDriverPrivilege 4940 EEbcvWs.exe Token: SeLoadDriverPrivilege 4048 EEbcvWs.exe Token: SeLoadDriverPrivilege 520 EEbcvWs.exe Token: SeLoadDriverPrivilege 2816 EEbcvWs.exe Token: SeLoadDriverPrivilege 2712 EEbcvWs.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 768 wrote to memory of 4360 768 b8a9514036e06c218c044600d103b049ccdc131ed6638a5f52651ba687c815a7.exe 82 PID 768 wrote to memory of 4360 768 b8a9514036e06c218c044600d103b049ccdc131ed6638a5f52651ba687c815a7.exe 82 PID 768 wrote to memory of 4360 768 b8a9514036e06c218c044600d103b049ccdc131ed6638a5f52651ba687c815a7.exe 82 PID 4360 wrote to memory of 4392 4360 EEbcvWs.exe 83 PID 4360 wrote to memory of 4392 4360 EEbcvWs.exe 83 PID 4360 wrote to memory of 4392 4360 EEbcvWs.exe 83 PID 4392 wrote to memory of 4660 4392 EEbcvWs.exe 84 PID 4392 wrote to memory of 4660 4392 EEbcvWs.exe 84 PID 4392 wrote to memory of 4660 4392 EEbcvWs.exe 84 PID 4660 wrote to memory of 1644 4660 EEbcvWs.exe 85 PID 4660 wrote to memory of 1644 4660 EEbcvWs.exe 85 PID 4660 wrote to memory of 1644 4660 EEbcvWs.exe 85 PID 1644 wrote to memory of 820 1644 EEbcvWs.exe 86 PID 1644 wrote to memory of 820 1644 EEbcvWs.exe 86 PID 1644 wrote to memory of 820 1644 EEbcvWs.exe 86 PID 820 wrote to memory of 1516 820 EEbcvWs.exe 87 PID 820 wrote to memory of 1516 820 EEbcvWs.exe 87 PID 820 wrote to memory of 1516 820 EEbcvWs.exe 87 PID 1516 wrote to memory of 1836 1516 EEbcvWs.exe 88 PID 1516 wrote to memory of 1836 1516 EEbcvWs.exe 88 PID 1516 wrote to memory of 1836 1516 EEbcvWs.exe 88 PID 1836 wrote to memory of 2480 1836 EEbcvWs.exe 89 PID 1836 wrote to memory of 2480 1836 EEbcvWs.exe 89 PID 1836 wrote to memory of 2480 1836 EEbcvWs.exe 89 PID 2480 wrote to memory of 4716 2480 EEbcvWs.exe 90 PID 2480 wrote to memory of 4716 2480 EEbcvWs.exe 90 PID 2480 wrote to memory of 4716 2480 EEbcvWs.exe 90 PID 4716 wrote to memory of 2652 4716 EEbcvWs.exe 91 PID 4716 wrote to memory of 2652 4716 EEbcvWs.exe 91 PID 4716 wrote to memory of 2652 4716 EEbcvWs.exe 91 PID 2652 wrote to memory of 1252 2652 EEbcvWs.exe 92 PID 2652 wrote to memory of 1252 2652 EEbcvWs.exe 92 PID 2652 wrote to memory of 1252 2652 EEbcvWs.exe 92 PID 1252 wrote to memory of 3480 1252 EEbcvWs.exe 93 PID 1252 wrote to memory of 3480 1252 EEbcvWs.exe 93 PID 1252 wrote to memory of 3480 1252 EEbcvWs.exe 93 PID 3480 wrote to memory of 308 3480 EEbcvWs.exe 94 PID 3480 wrote to memory of 308 3480 EEbcvWs.exe 94 PID 3480 wrote to memory of 308 3480 EEbcvWs.exe 94 PID 308 wrote to memory of 228 308 EEbcvWs.exe 95 PID 308 wrote to memory of 228 308 EEbcvWs.exe 95 PID 308 wrote to memory of 228 308 EEbcvWs.exe 95 PID 228 wrote to memory of 3532 228 EEbcvWs.exe 96 PID 228 wrote to memory of 3532 228 EEbcvWs.exe 96 PID 228 wrote to memory of 3532 228 EEbcvWs.exe 96 PID 3532 wrote to memory of 1108 3532 EEbcvWs.exe 97 PID 3532 wrote to memory of 1108 3532 EEbcvWs.exe 97 PID 3532 wrote to memory of 1108 3532 EEbcvWs.exe 97 PID 1108 wrote to memory of 2044 1108 EEbcvWs.exe 98 PID 1108 wrote to memory of 2044 1108 EEbcvWs.exe 98 PID 1108 wrote to memory of 2044 1108 EEbcvWs.exe 98 PID 2044 wrote to memory of 4228 2044 EEbcvWs.exe 99 PID 2044 wrote to memory of 4228 2044 EEbcvWs.exe 99 PID 2044 wrote to memory of 4228 2044 EEbcvWs.exe 99 PID 4228 wrote to memory of 3820 4228 EEbcvWs.exe 100 PID 4228 wrote to memory of 3820 4228 EEbcvWs.exe 100 PID 4228 wrote to memory of 3820 4228 EEbcvWs.exe 100 PID 3820 wrote to memory of 3868 3820 EEbcvWs.exe 101 PID 3820 wrote to memory of 3868 3820 EEbcvWs.exe 101 PID 3820 wrote to memory of 3868 3820 EEbcvWs.exe 101 PID 3868 wrote to memory of 2936 3868 EEbcvWs.exe 102 PID 3868 wrote to memory of 2936 3868 EEbcvWs.exe 102 PID 3868 wrote to memory of 2936 3868 EEbcvWs.exe 102 PID 2936 wrote to memory of 3136 2936 EEbcvWs.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8a9514036e06c218c044600d103b049ccdc131ed6638a5f52651ba687c815a7.exe"C:\Users\Admin\AppData\Local\Temp\b8a9514036e06c218c044600d103b049ccdc131ed6638a5f52651ba687c815a7.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe5⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:308 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe18⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe22⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3136 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1344 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4276 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4880 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4116 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4468 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4464 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe30⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:3720 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1468 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2368 -
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe33⤵PID:19552
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe32⤵PID:19460
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe31⤵PID:19164
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe30⤵PID:18916
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe29⤵PID:18736
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe30⤵PID:18840
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe28⤵PID:18708
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe27⤵PID:18672
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe26⤵PID:18580
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe27⤵PID:18816
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe25⤵PID:18652
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe26⤵PID:18824
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe24⤵PID:18628
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe25⤵PID:18832
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe23⤵PID:880
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe24⤵PID:19000
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe22⤵PID:18184
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe21⤵PID:18140
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe20⤵PID:18064
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe21⤵PID:18380
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe19⤵PID:17864
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe20⤵PID:18396
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe21⤵PID:18896
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe22⤵PID:19768
-
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe18⤵PID:17848
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe19⤵PID:18156
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe20⤵PID:18228
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe17⤵PID:17788
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe18⤵PID:18016
-
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe14⤵PID:16848
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe11⤵PID:16296
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe10⤵PID:16248
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe9⤵PID:16148
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe8⤵PID:15912
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe9⤵PID:16016
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe10⤵PID:16220
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe11⤵PID:15440
-
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe7⤵PID:15872
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe8⤵PID:16000
-
-
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe3⤵PID:15512
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe2⤵PID:15400
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe3⤵PID:15432
-
-
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3044 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:796 -
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe3⤵PID:20080
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe2⤵PID:19596
-
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:424 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2760 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1612 -
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe4⤵PID:20368
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe3⤵PID:20120
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe2⤵PID:19624
-
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2296 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2836 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2792 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe4⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4772 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2780 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2588 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2404 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe8⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3904 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1044 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2324 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4280 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4992 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4136 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4724 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:764 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4340 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3288 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1944 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1124 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3992 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5052 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2088 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4940 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4048 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:520 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2816 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe27⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2712 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe28⤵
- Executes dropped EXE
PID:1928 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe29⤵PID:4832
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe30⤵PID:3936
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe31⤵PID:488
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe32⤵PID:4644
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe33⤵PID:1144
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe34⤵
- Drops file in System32 directory
PID:3396 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe35⤵PID:440
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe36⤵PID:1432
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe37⤵
- Enumerates connected drives
PID:4140 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe38⤵PID:3476
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe39⤵PID:3496
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe40⤵
- Enumerates connected drives
PID:212 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe41⤵PID:3512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe4⤵PID:20848
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe3⤵PID:20684
-
-
-
C:\Windows\SysWOW64\EEbcvWs\Vc87pWX.exeC:\Windows\system32\EEbcvWs\Vc87pWX.exe2⤵PID:20292
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe3⤵PID:20416
-
-
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe1⤵PID:2868
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe2⤵PID:2384
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe3⤵
- Drops file in System32 directory
PID:4064 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe4⤵PID:4408
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe5⤵
- Enumerates connected drives
PID:4748 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe6⤵PID:4584
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe7⤵
- Enumerates connected drives
PID:4708 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe8⤵PID:3000
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe9⤵
- Drops file in System32 directory
PID:924 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe10⤵PID:4656
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe11⤵PID:1572
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe12⤵PID:2756
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe13⤵PID:1480
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe14⤵
- Enumerates connected drives
PID:2568 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe15⤵PID:4808
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe16⤵PID:444
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe17⤵PID:328
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe18⤵
- Enumerates connected drives
PID:3696 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe19⤵PID:4700
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe20⤵
- Drops file in System32 directory
PID:4812 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe21⤵PID:3440
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe22⤵PID:3132
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe23⤵
- Enumerates connected drives
PID:3632 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe24⤵PID:1280
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe25⤵PID:4008
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe26⤵PID:1844
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe27⤵PID:3324
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe28⤵PID:2656
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe29⤵PID:2068
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe30⤵PID:4416
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe31⤵
- Drops file in System32 directory
PID:3588 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe32⤵PID:4448
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe33⤵
- Enumerates connected drives
PID:3964 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe34⤵
- Enumerates connected drives
PID:3852 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe35⤵
- Drops file in System32 directory
PID:1812 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe36⤵PID:1272
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe37⤵PID:1808
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe38⤵PID:1388
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe39⤵PID:1980
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe40⤵PID:5128
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe41⤵
- Enumerates connected drives
PID:5148 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe42⤵PID:5168
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe43⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:5188 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe44⤵PID:5212
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe45⤵PID:5232
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe46⤵PID:5256
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe47⤵PID:5272
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe48⤵
- Enumerates connected drives
PID:5288 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe49⤵PID:5308
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe50⤵PID:5324
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe51⤵PID:5340
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe52⤵PID:5356
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe53⤵PID:5372
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe54⤵PID:5388
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe55⤵PID:5404
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe56⤵PID:5428
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe57⤵PID:5452
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe58⤵
- Drops file in System32 directory
PID:5468 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe59⤵
- Drops file in System32 directory
PID:5492 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe60⤵
- Enumerates connected drives
PID:5512 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe61⤵
- Enumerates connected drives
PID:5536 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe62⤵
- Enumerates connected drives
PID:5552 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe63⤵PID:5576
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe64⤵PID:5592
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe65⤵PID:5616
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe66⤵PID:5632
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe67⤵PID:5656
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe68⤵PID:5672
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe69⤵
- Enumerates connected drives
PID:5696 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe70⤵PID:5716
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe71⤵
- Drops file in System32 directory
PID:5740 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe72⤵PID:5760
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe73⤵PID:5784
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe74⤵
- Enumerates connected drives
PID:5804 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe75⤵
- Enumerates connected drives
PID:5824 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe76⤵
- Drops file in System32 directory
PID:5848 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe77⤵PID:5864
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe78⤵PID:5888
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe79⤵PID:5908
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe80⤵PID:5932
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe81⤵PID:5948
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe82⤵PID:5972
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe83⤵PID:5988
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe84⤵
- Enumerates connected drives
PID:6004 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe85⤵PID:6020
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe86⤵
- Enumerates connected drives
PID:6036 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe87⤵PID:6052
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe88⤵PID:6068
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe89⤵
- Enumerates connected drives
PID:6084 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe90⤵
- Enumerates connected drives
PID:6100 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe91⤵PID:6116
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe92⤵PID:6132
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe93⤵
- Drops file in System32 directory
PID:5140 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe94⤵
- Drops file in System32 directory
PID:5200 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe95⤵PID:5416
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe96⤵
- Enumerates connected drives
PID:5500 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe97⤵PID:5584
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe98⤵PID:5704
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe99⤵PID:5780
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe100⤵PID:5876
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe101⤵PID:5160
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe102⤵PID:5664
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe103⤵PID:5836
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe104⤵
- Enumerates connected drives
PID:6160 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe105⤵PID:6184
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe106⤵PID:6200
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe107⤵PID:6224
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe108⤵PID:6240
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe109⤵PID:6264
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe110⤵PID:6280
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe111⤵
- Enumerates connected drives
PID:6304 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe112⤵
- Enumerates connected drives
PID:6320 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe113⤵
- Drops file in System32 directory
PID:6348 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe114⤵PID:6364
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe115⤵PID:6384
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe116⤵
- Enumerates connected drives
PID:6408 -
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe117⤵PID:6428
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe118⤵PID:6448
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe119⤵PID:6472
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe120⤵PID:6488
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe121⤵PID:6508
-
C:\Windows\SysWOW64\Vc87pWX\EEbcvWs.exeC:\Windows\system32\Vc87pWX\EEbcvWs.exe122⤵
- Drops file in System32 directory
PID:6528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-