Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
185s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 18:06
Static task
static1
Behavioral task
behavioral1
Sample
b3d62ee4cde935ac1e53220bb11010f6bd3bb1051389d8934e4d134e3b31eec0.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b3d62ee4cde935ac1e53220bb11010f6bd3bb1051389d8934e4d134e3b31eec0.exe
Resource
win10v2004-20220812-en
General
-
Target
b3d62ee4cde935ac1e53220bb11010f6bd3bb1051389d8934e4d134e3b31eec0.exe
-
Size
27KB
-
MD5
6b3d7530443bcb5f6fd81bca82cefbde
-
SHA1
4771f2b694034375a107927ed3efbc7ac6d6cdde
-
SHA256
b3d62ee4cde935ac1e53220bb11010f6bd3bb1051389d8934e4d134e3b31eec0
-
SHA512
08b5a75bc2b9b5c599ffb4c447dd71018beea75f4d5043a9b2306436e0bcfde157d1504e1e476160ba24671069297d0d1a77d1c131c99577b6b72000db6e54e4
-
SSDEEP
384:yBwNzpKTd/clWC9SOBmDZlOXDK/4ytB46o:yB4KThclBXRuw246o
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4308 svchost.exe 2000 svchost.exe 1436 svchost.exe 3324 svchost.exe 1044 svchost.exe 2784 svchost.exe 372 svchost.exe 648 svchost.exe 3904 svchost.exe 4328 svchost.exe 2312 svchost.exe 2128 svchost.exe 4532 svchost.exe 1352 svchost.exe 360 svchost.exe 572 svchost.exe 2528 svchost.exe 3472 svchost.exe 1228 svchost.exe 1288 svchost.exe 3648 svchost.exe 2624 svchost.exe 2388 svchost.exe 3512 svchost.exe 3640 svchost.exe 2752 svchost.exe 2120 svchost.exe 2004 svchost.exe 3692 svchost.exe 2172 svchost.exe 1848 svchost.exe 560 svchost.exe 2536 svchost.exe 924 svchost.exe 1880 svchost.exe 3948 svchost.exe 4912 svchost.exe 4760 svchost.exe 4960 svchost.exe 3424 svchost.exe 4544 svchost.exe 1428 svchost.exe 1704 svchost.exe 4388 svchost.exe 3404 svchost.exe 1012 svchost.exe 3928 svchost.exe 3040 svchost.exe 3664 svchost.exe 548 svchost.exe 4252 svchost.exe 4948 svchost.exe 5044 svchost.exe 1392 svchost.exe 1664 svchost.exe 2596 svchost.exe 980 svchost.exe 2620 svchost.exe 1248 svchost.exe 1464 svchost.exe 5112 svchost.exe 3648 svchost.exe 2052 svchost.exe 3052 svchost.exe -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe File created C:\Windows\svchost.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4960 b3d62ee4cde935ac1e53220bb11010f6bd3bb1051389d8934e4d134e3b31eec0.exe Token: SeDebugPrivilege 4308 svchost.exe Token: SeDebugPrivilege 2000 svchost.exe Token: SeDebugPrivilege 1436 svchost.exe Token: SeDebugPrivilege 3324 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 2784 svchost.exe Token: SeDebugPrivilege 372 svchost.exe Token: SeDebugPrivilege 648 svchost.exe Token: SeDebugPrivilege 3904 svchost.exe Token: SeDebugPrivilege 4328 svchost.exe Token: SeDebugPrivilege 2312 svchost.exe Token: SeDebugPrivilege 2128 svchost.exe Token: SeDebugPrivilege 4532 svchost.exe Token: SeDebugPrivilege 1352 svchost.exe Token: SeDebugPrivilege 360 svchost.exe Token: SeDebugPrivilege 572 svchost.exe Token: SeDebugPrivilege 2528 svchost.exe Token: SeDebugPrivilege 3472 svchost.exe Token: SeDebugPrivilege 1228 svchost.exe Token: SeDebugPrivilege 1288 svchost.exe Token: SeDebugPrivilege 3648 svchost.exe Token: SeDebugPrivilege 2624 svchost.exe Token: SeDebugPrivilege 2388 svchost.exe Token: SeDebugPrivilege 3512 svchost.exe Token: SeDebugPrivilege 3640 svchost.exe Token: SeDebugPrivilege 2752 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2004 svchost.exe Token: SeDebugPrivilege 3692 svchost.exe Token: SeDebugPrivilege 2172 svchost.exe Token: SeDebugPrivilege 1848 svchost.exe Token: SeDebugPrivilege 560 svchost.exe Token: SeDebugPrivilege 2536 svchost.exe Token: SeDebugPrivilege 924 svchost.exe Token: SeDebugPrivilege 1880 svchost.exe Token: SeDebugPrivilege 3948 svchost.exe Token: SeDebugPrivilege 4912 svchost.exe Token: SeDebugPrivilege 4760 svchost.exe Token: SeDebugPrivilege 4960 svchost.exe Token: SeDebugPrivilege 3424 svchost.exe Token: SeDebugPrivilege 4544 svchost.exe Token: SeDebugPrivilege 1428 svchost.exe Token: SeDebugPrivilege 1704 svchost.exe Token: SeDebugPrivilege 4388 svchost.exe Token: SeDebugPrivilege 3404 svchost.exe Token: SeDebugPrivilege 1012 svchost.exe Token: SeDebugPrivilege 3928 svchost.exe Token: SeDebugPrivilege 3040 svchost.exe Token: SeDebugPrivilege 3664 svchost.exe Token: SeDebugPrivilege 548 svchost.exe Token: SeDebugPrivilege 4252 svchost.exe Token: SeDebugPrivilege 4948 svchost.exe Token: SeDebugPrivilege 5044 svchost.exe Token: SeDebugPrivilege 1392 svchost.exe Token: SeDebugPrivilege 1664 svchost.exe Token: SeDebugPrivilege 2596 svchost.exe Token: SeDebugPrivilege 980 svchost.exe Token: SeDebugPrivilege 2620 svchost.exe Token: SeDebugPrivilege 1248 svchost.exe Token: SeDebugPrivilege 1464 svchost.exe Token: SeDebugPrivilege 5112 svchost.exe Token: SeDebugPrivilege 3648 svchost.exe Token: SeDebugPrivilege 2052 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4960 wrote to memory of 4308 4960 b3d62ee4cde935ac1e53220bb11010f6bd3bb1051389d8934e4d134e3b31eec0.exe 81 PID 4960 wrote to memory of 4308 4960 b3d62ee4cde935ac1e53220bb11010f6bd3bb1051389d8934e4d134e3b31eec0.exe 81 PID 4960 wrote to memory of 4308 4960 b3d62ee4cde935ac1e53220bb11010f6bd3bb1051389d8934e4d134e3b31eec0.exe 81 PID 4308 wrote to memory of 2000 4308 svchost.exe 82 PID 4308 wrote to memory of 2000 4308 svchost.exe 82 PID 4308 wrote to memory of 2000 4308 svchost.exe 82 PID 2000 wrote to memory of 1436 2000 svchost.exe 83 PID 2000 wrote to memory of 1436 2000 svchost.exe 83 PID 2000 wrote to memory of 1436 2000 svchost.exe 83 PID 1436 wrote to memory of 3324 1436 svchost.exe 84 PID 1436 wrote to memory of 3324 1436 svchost.exe 84 PID 1436 wrote to memory of 3324 1436 svchost.exe 84 PID 3324 wrote to memory of 1044 3324 svchost.exe 85 PID 3324 wrote to memory of 1044 3324 svchost.exe 85 PID 3324 wrote to memory of 1044 3324 svchost.exe 85 PID 1044 wrote to memory of 2784 1044 svchost.exe 86 PID 1044 wrote to memory of 2784 1044 svchost.exe 86 PID 1044 wrote to memory of 2784 1044 svchost.exe 86 PID 2784 wrote to memory of 372 2784 svchost.exe 87 PID 2784 wrote to memory of 372 2784 svchost.exe 87 PID 2784 wrote to memory of 372 2784 svchost.exe 87 PID 372 wrote to memory of 648 372 svchost.exe 88 PID 372 wrote to memory of 648 372 svchost.exe 88 PID 372 wrote to memory of 648 372 svchost.exe 88 PID 648 wrote to memory of 3904 648 svchost.exe 89 PID 648 wrote to memory of 3904 648 svchost.exe 89 PID 648 wrote to memory of 3904 648 svchost.exe 89 PID 3904 wrote to memory of 4328 3904 svchost.exe 90 PID 3904 wrote to memory of 4328 3904 svchost.exe 90 PID 3904 wrote to memory of 4328 3904 svchost.exe 90 PID 4328 wrote to memory of 2312 4328 svchost.exe 91 PID 4328 wrote to memory of 2312 4328 svchost.exe 91 PID 4328 wrote to memory of 2312 4328 svchost.exe 91 PID 2312 wrote to memory of 2128 2312 svchost.exe 92 PID 2312 wrote to memory of 2128 2312 svchost.exe 92 PID 2312 wrote to memory of 2128 2312 svchost.exe 92 PID 2128 wrote to memory of 4532 2128 svchost.exe 93 PID 2128 wrote to memory of 4532 2128 svchost.exe 93 PID 2128 wrote to memory of 4532 2128 svchost.exe 93 PID 4532 wrote to memory of 1352 4532 svchost.exe 94 PID 4532 wrote to memory of 1352 4532 svchost.exe 94 PID 4532 wrote to memory of 1352 4532 svchost.exe 94 PID 1352 wrote to memory of 360 1352 svchost.exe 95 PID 1352 wrote to memory of 360 1352 svchost.exe 95 PID 1352 wrote to memory of 360 1352 svchost.exe 95 PID 360 wrote to memory of 572 360 svchost.exe 96 PID 360 wrote to memory of 572 360 svchost.exe 96 PID 360 wrote to memory of 572 360 svchost.exe 96 PID 572 wrote to memory of 2528 572 svchost.exe 97 PID 572 wrote to memory of 2528 572 svchost.exe 97 PID 572 wrote to memory of 2528 572 svchost.exe 97 PID 2528 wrote to memory of 3472 2528 svchost.exe 98 PID 2528 wrote to memory of 3472 2528 svchost.exe 98 PID 2528 wrote to memory of 3472 2528 svchost.exe 98 PID 3472 wrote to memory of 1228 3472 svchost.exe 99 PID 3472 wrote to memory of 1228 3472 svchost.exe 99 PID 3472 wrote to memory of 1228 3472 svchost.exe 99 PID 1228 wrote to memory of 1288 1228 svchost.exe 100 PID 1228 wrote to memory of 1288 1228 svchost.exe 100 PID 1228 wrote to memory of 1288 1228 svchost.exe 100 PID 1288 wrote to memory of 3648 1288 svchost.exe 101 PID 1288 wrote to memory of 3648 1288 svchost.exe 101 PID 1288 wrote to memory of 3648 1288 svchost.exe 101 PID 3648 wrote to memory of 2624 3648 svchost.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3d62ee4cde935ac1e53220bb11010f6bd3bb1051389d8934e4d134e3b31eec0.exe"C:\Users\Admin\AppData\Local\Temp\b3d62ee4cde935ac1e53220bb11010f6bd3bb1051389d8934e4d134e3b31eec0.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"8⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"9⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"11⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"12⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"16⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"18⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"23⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2624 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"24⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2388 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"25⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:3512 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3640 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"27⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:2752 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"28⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:2120 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"29⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:2004 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"30⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3692 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2172 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1848 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:560 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"34⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2536 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:924 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"36⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:1880 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3948 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"38⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4912 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4760 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4960 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3424 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4544 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1428 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"44⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:1704 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"45⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4388 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"46⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:3404 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"47⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1012 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3928 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3040 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3664 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:548 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4252 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4948 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"54⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5044 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1392 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1664 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"57⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2596 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"58⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:980 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2620 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1248 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1464 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"62⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5112 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3648 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"64⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2052 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3052 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"66⤵
- Checks computer location settings
PID:4072 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"67⤵PID:4592
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"68⤵PID:3596
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"69⤵
- Modifies registry class
PID:2208 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"70⤵
- Checks computer location settings
PID:2220 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"71⤵
- Modifies registry class
PID:920 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"72⤵
- Checks computer location settings
- Modifies registry class
PID:1900 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"73⤵PID:5104
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"74⤵
- Modifies registry class
PID:1868 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"75⤵PID:3936
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"76⤵PID:560
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"77⤵
- Drops file in Windows directory
PID:2180 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"78⤵PID:3912
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"79⤵
- Modifies registry class
PID:2628 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"80⤵
- Drops file in Windows directory
PID:4088 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"81⤵
- Checks computer location settings
- Drops file in Windows directory
PID:1736 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"82⤵
- Drops file in Windows directory
- Modifies registry class
PID:4968 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"83⤵
- Drops file in Windows directory
- Modifies registry class
PID:4804 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"84⤵PID:4960
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"85⤵
- Checks computer location settings
PID:1200 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"86⤵
- Checks computer location settings
PID:1060 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"87⤵
- Modifies registry class
PID:4352 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"88⤵
- Checks computer location settings
PID:2552 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"89⤵PID:4092
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"90⤵
- Checks computer location settings
PID:3084 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"91⤵
- Checks computer location settings
PID:1080 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"92⤵
- Drops file in Windows directory
- Modifies registry class
PID:3776 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"93⤵
- Modifies registry class
PID:1908 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"94⤵
- Modifies registry class
PID:3008 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"95⤵PID:3652
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"96⤵PID:3264
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"97⤵
- Modifies registry class
PID:2728 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"98⤵
- Drops file in Windows directory
PID:4252 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"99⤵PID:4964
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"100⤵
- Drops file in Windows directory
PID:628 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"101⤵PID:780
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"102⤵PID:3212
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"103⤵
- Checks computer location settings
PID:976 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"104⤵
- Modifies registry class
PID:2528 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"105⤵PID:3472
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"106⤵
- Checks computer location settings
- Modifies registry class
PID:988 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"107⤵PID:4928
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"108⤵
- Modifies registry class
PID:1948 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"109⤵PID:1408
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"110⤵
- Drops file in Windows directory
PID:4000 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"111⤵PID:4240
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"112⤵
- Drops file in Windows directory
PID:3512 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"113⤵
- Checks computer location settings
PID:4280 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"114⤵PID:2760
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"115⤵
- Checks computer location settings
PID:3596 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"116⤵
- Drops file in Windows directory
- Modifies registry class
PID:1064 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"117⤵
- Checks computer location settings
PID:768 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"118⤵PID:964
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"119⤵PID:1888
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"120⤵
- Checks computer location settings
PID:4040 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"121⤵
- Drops file in Windows directory
PID:1040 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"122⤵PID:4972
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-