Analysis
-
max time kernel
91s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 12:06
Static task
static1
Behavioral task
behavioral1
Sample
de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
Resource
win10v2004-20220901-en
General
-
Target
de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe
-
Size
184KB
-
MD5
b63ba40bfabed8ee98e2b6c951987368
-
SHA1
a20a3caf3cfd2671fd4ee50b258caae1c27542a4
-
SHA256
de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b
-
SHA512
903164fd610583a34e119de0f4c0703f311406874be47479cbfcfa7695fbcb2ae25fa16c62cfa879dfa5ea96736d90ec7fb1aa58ed7c932b0312515ba2fe82eb
-
SSDEEP
3072:/U/KGW8seST3aQgHw0I+Kaj7Fep0FmRFv7VL/wUNx1MZp2cyP/wZYfmELb8mZW2v:/ywoQ0jRCF7DiGTwYO35E8at
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe Token: SeDebugPrivilege 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4372 wrote to memory of 3036 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 54 PID 4372 wrote to memory of 620 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 3 PID 4372 wrote to memory of 668 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 1 PID 4372 wrote to memory of 776 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 8 PID 4372 wrote to memory of 784 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 31 PID 4372 wrote to memory of 792 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 20 PID 4372 wrote to memory of 896 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 14 PID 4372 wrote to memory of 948 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 12 PID 4372 wrote to memory of 1020 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 9 PID 4372 wrote to memory of 484 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 10 PID 4372 wrote to memory of 400 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 11 PID 4372 wrote to memory of 656 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 13 PID 4372 wrote to memory of 984 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 17 PID 4372 wrote to memory of 1028 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 15 PID 4372 wrote to memory of 1124 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 16 PID 4372 wrote to memory of 1156 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 18 PID 4372 wrote to memory of 1288 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 19 PID 4372 wrote to memory of 1320 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 21 PID 4372 wrote to memory of 1328 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 22 PID 4372 wrote to memory of 1376 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 23 PID 4372 wrote to memory of 1384 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 25 PID 4372 wrote to memory of 1516 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 24 PID 4372 wrote to memory of 1524 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 26 PID 4372 wrote to memory of 1588 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 27 PID 4372 wrote to memory of 1604 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 28 PID 4372 wrote to memory of 1636 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 29 PID 4372 wrote to memory of 1732 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 30 PID 4372 wrote to memory of 1772 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 33 PID 4372 wrote to memory of 1868 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 32 PID 4372 wrote to memory of 1876 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 34 PID 4372 wrote to memory of 1936 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 35 PID 4372 wrote to memory of 1944 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 36 PID 4372 wrote to memory of 1268 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 37 PID 4372 wrote to memory of 368 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 38 PID 4372 wrote to memory of 1788 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 79 PID 4372 wrote to memory of 1916 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 39 PID 4372 wrote to memory of 2080 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 41 PID 4372 wrote to memory of 2260 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 40 PID 4372 wrote to memory of 2276 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 78 PID 4372 wrote to memory of 2364 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 42 PID 4372 wrote to memory of 2488 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 77 PID 4372 wrote to memory of 2500 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 76 PID 4372 wrote to memory of 2644 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 75 PID 4372 wrote to memory of 2652 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 74 PID 4372 wrote to memory of 2704 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 43 PID 4372 wrote to memory of 2732 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 73 PID 4372 wrote to memory of 2740 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 44 PID 4372 wrote to memory of 2752 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 55 PID 4372 wrote to memory of 8 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 52 PID 4372 wrote to memory of 3260 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 51 PID 4372 wrote to memory of 3364 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 48 PID 4372 wrote to memory of 3432 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 46 PID 4372 wrote to memory of 3520 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 47 PID 4372 wrote to memory of 3720 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 49 PID 4372 wrote to memory of 4276 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 53 PID 4372 wrote to memory of 4688 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 72 PID 4372 wrote to memory of 1612 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 70 PID 4372 wrote to memory of 2376 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 68 PID 4372 wrote to memory of 5008 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 67 PID 4372 wrote to memory of 480 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 66 PID 4372 wrote to memory of 4740 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 65 PID 4372 wrote to memory of 3712 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 64 PID 4372 wrote to memory of 4056 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 63 PID 4372 wrote to memory of 3060 4372 de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe 62
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:668
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:620
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:1020
-
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:784
-
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:484
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:400
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:948
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:656
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:896
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:1028
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1124
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2364
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:984
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1156
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1288
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:792
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3432
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:3520
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:3364
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3720
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3260
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:4276
-
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:3712
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe2⤵PID:4740
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4688
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1320
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1328
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2260
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1376
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1516
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1384
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1524
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1588
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1604
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s FontCache1⤵PID:1636
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1732
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1868
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1772
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1876
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1936
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1944
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1268
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:368
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:1916
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2080
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2704
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2740
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:8
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe"C:\Users\Admin\AppData\Local\Temp\de364b69384d38d5b4a4205e9f686a784ef731a8a8366f81aebb09b16cbd462b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4372
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2752
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵PID:4388
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:2312
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵PID:1072
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time1⤵PID:3060
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:4056
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:5008
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:2376
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:1612
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2732
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2652
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:2644
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2500
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2488
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2276
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1788