Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 17:48
Static task
static1
Behavioral task
behavioral1
Sample
51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe
Resource
win10v2004-20220812-en
General
-
Target
51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe
-
Size
35KB
-
MD5
0ed165387ae92b644bca5a821b924de0
-
SHA1
1bb759fca7db7df1265fb2680e11cba2468be266
-
SHA256
51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e
-
SHA512
aaf20c47f8d6991713256aa8c3fff513a6465af19f80151de9cc0376a6ec3b3c8b2fe520a95f5330f06916ab986908bf4b6403a39c51b3f3cb74f6eed529626f
-
SSDEEP
768:oau+UoFJ4NINSkmfaQJXWi/XNNa8KSzXQn3:XUUJ4Nkmfa6GedXjC
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\DRIVERS\ETC\HOSTS 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
pid Process 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4300 wrote to memory of 596 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 3 PID 4300 wrote to memory of 596 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 3 PID 4300 wrote to memory of 596 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 3 PID 4300 wrote to memory of 596 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 3 PID 4300 wrote to memory of 596 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 3 PID 4300 wrote to memory of 596 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 3 PID 4300 wrote to memory of 672 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 1 PID 4300 wrote to memory of 672 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 1 PID 4300 wrote to memory of 672 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 1 PID 4300 wrote to memory of 672 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 1 PID 4300 wrote to memory of 672 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 1 PID 4300 wrote to memory of 672 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 1 PID 4300 wrote to memory of 776 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 78 PID 4300 wrote to memory of 776 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 78 PID 4300 wrote to memory of 776 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 78 PID 4300 wrote to memory of 776 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 78 PID 4300 wrote to memory of 776 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 78 PID 4300 wrote to memory of 776 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 78 PID 4300 wrote to memory of 784 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 77 PID 4300 wrote to memory of 784 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 77 PID 4300 wrote to memory of 784 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 77 PID 4300 wrote to memory of 784 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 77 PID 4300 wrote to memory of 784 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 77 PID 4300 wrote to memory of 784 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 77 PID 4300 wrote to memory of 796 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 76 PID 4300 wrote to memory of 796 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 76 PID 4300 wrote to memory of 796 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 76 PID 4300 wrote to memory of 796 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 76 PID 4300 wrote to memory of 796 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 76 PID 4300 wrote to memory of 796 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 76 PID 4300 wrote to memory of 908 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 11 PID 4300 wrote to memory of 908 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 11 PID 4300 wrote to memory of 908 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 11 PID 4300 wrote to memory of 908 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 11 PID 4300 wrote to memory of 908 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 11 PID 4300 wrote to memory of 908 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 11 PID 4300 wrote to memory of 956 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 8 PID 4300 wrote to memory of 956 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 8 PID 4300 wrote to memory of 956 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 8 PID 4300 wrote to memory of 956 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 8 PID 4300 wrote to memory of 956 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 8 PID 4300 wrote to memory of 956 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 8 PID 4300 wrote to memory of 60 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 10 PID 4300 wrote to memory of 60 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 10 PID 4300 wrote to memory of 60 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 10 PID 4300 wrote to memory of 60 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 10 PID 4300 wrote to memory of 60 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 10 PID 4300 wrote to memory of 60 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 10 PID 4300 wrote to memory of 524 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 9 PID 4300 wrote to memory of 524 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 9 PID 4300 wrote to memory of 524 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 9 PID 4300 wrote to memory of 524 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 9 PID 4300 wrote to memory of 524 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 9 PID 4300 wrote to memory of 524 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 9 PID 4300 wrote to memory of 700 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 75 PID 4300 wrote to memory of 700 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 75 PID 4300 wrote to memory of 700 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 75 PID 4300 wrote to memory of 700 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 75 PID 4300 wrote to memory of 700 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 75 PID 4300 wrote to memory of 700 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 75 PID 4300 wrote to memory of 952 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 74 PID 4300 wrote to memory of 952 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 74 PID 4300 wrote to memory of 952 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 74 PID 4300 wrote to memory of 952 4300 51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe 74
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:672
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:596
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:60
-
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:784
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:956
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:524
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:908
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1144
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2580
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1324
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2436
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1604
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1860
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1980
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2280
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:2532
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2644
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3216
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3572
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3508
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3416
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:1504
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:2508
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time1⤵PID:3140
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵PID:3056
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe1⤵PID:3812
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:1440
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:820
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:4520
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵PID:4184
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4604
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4420
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3832
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3660
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe"C:\Users\Admin\AppData\Local\Temp\51e1c540a6231ed47cd6e17f24cf8f5145ef361736a11f66f6522308a5f62e6e.exe"2⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:5048
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2656
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2628
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2592
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2524
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2444
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2292
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2152
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2100
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:1780
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1744
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1916
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1908
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1880
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1756
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1716
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s FontCache1⤵PID:1628
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1568
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1544
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1472
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1396
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1388
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1248
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1220
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1192
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1052
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1044
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:952
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:700
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:796
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776