23faf7e974723811a912cc9a4e1268518ec97616a2b30712d04a47c5e6a866eb

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 09:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63993ea94de3ce89027c438b773d897e.exe
Size

59KB
MD5

63993ea94de3ce89027c438b773d897e
SHA1

445b2dd598635dc9695c993348b33cd877be3991
SHA256

23faf7e974723811a912cc9a4e1268518ec97616a2b30712d04a47c5e6a866eb
SHA512

4460ae7808bfab57c2c7352f7649210d4107ecd1a6b5d3bc8e468b283c56666b20b7ce065695c328718a89fc0a2eaea222f215d0e1d1f7cdf50dc1d1fc5066f1
SSDEEP

1536:iRcbnPPGm7cP6XMvPwvIHXNsoUUlcVbV3feMZ+xaD3Vy7brNxx:iayOMvPwvIHXaoN6VbV3P/M7XNxx

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe
1332	63993ea94de3ce89027c438b773d897e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1332	63993ea94de3ce89027c438b773d897e.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 624	1332	63993ea94de3ce89027c438b773d897e.exe	82
PID 1332 wrote to memory of 624	1332	63993ea94de3ce89027c438b773d897e.exe	82
PID 1332 wrote to memory of 624	1332	63993ea94de3ce89027c438b773d897e.exe	82
PID 1332 wrote to memory of 624	1332	63993ea94de3ce89027c438b773d897e.exe	82
PID 1332 wrote to memory of 624	1332	63993ea94de3ce89027c438b773d897e.exe	82
PID 1332 wrote to memory of 624	1332	63993ea94de3ce89027c438b773d897e.exe	82
PID 1332 wrote to memory of 680	1332	63993ea94de3ce89027c438b773d897e.exe	1
PID 1332 wrote to memory of 680	1332	63993ea94de3ce89027c438b773d897e.exe	1
PID 1332 wrote to memory of 680	1332	63993ea94de3ce89027c438b773d897e.exe	1
PID 1332 wrote to memory of 680	1332	63993ea94de3ce89027c438b773d897e.exe	1
PID 1332 wrote to memory of 680	1332	63993ea94de3ce89027c438b773d897e.exe	1
PID 1332 wrote to memory of 680	1332	63993ea94de3ce89027c438b773d897e.exe	1
PID 1332 wrote to memory of 780	1332	63993ea94de3ce89027c438b773d897e.exe	80
PID 1332 wrote to memory of 780	1332	63993ea94de3ce89027c438b773d897e.exe	80
PID 1332 wrote to memory of 780	1332	63993ea94de3ce89027c438b773d897e.exe	80
PID 1332 wrote to memory of 780	1332	63993ea94de3ce89027c438b773d897e.exe	80
PID 1332 wrote to memory of 780	1332	63993ea94de3ce89027c438b773d897e.exe	80
PID 1332 wrote to memory of 780	1332	63993ea94de3ce89027c438b773d897e.exe	80
PID 1332 wrote to memory of 788	1332	63993ea94de3ce89027c438b773d897e.exe	79
PID 1332 wrote to memory of 788	1332	63993ea94de3ce89027c438b773d897e.exe	79
PID 1332 wrote to memory of 788	1332	63993ea94de3ce89027c438b773d897e.exe	79
PID 1332 wrote to memory of 788	1332	63993ea94de3ce89027c438b773d897e.exe	79
PID 1332 wrote to memory of 788	1332	63993ea94de3ce89027c438b773d897e.exe	79
PID 1332 wrote to memory of 788	1332	63993ea94de3ce89027c438b773d897e.exe	79
PID 1332 wrote to memory of 796	1332	63993ea94de3ce89027c438b773d897e.exe	78
PID 1332 wrote to memory of 796	1332	63993ea94de3ce89027c438b773d897e.exe	78
PID 1332 wrote to memory of 796	1332	63993ea94de3ce89027c438b773d897e.exe	78
PID 1332 wrote to memory of 796	1332	63993ea94de3ce89027c438b773d897e.exe	78
PID 1332 wrote to memory of 796	1332	63993ea94de3ce89027c438b773d897e.exe	78
PID 1332 wrote to memory of 796	1332	63993ea94de3ce89027c438b773d897e.exe	78
PID 1332 wrote to memory of 896	1332	63993ea94de3ce89027c438b773d897e.exe	4
PID 1332 wrote to memory of 896	1332	63993ea94de3ce89027c438b773d897e.exe	4
PID 1332 wrote to memory of 896	1332	63993ea94de3ce89027c438b773d897e.exe	4
PID 1332 wrote to memory of 896	1332	63993ea94de3ce89027c438b773d897e.exe	4
PID 1332 wrote to memory of 896	1332	63993ea94de3ce89027c438b773d897e.exe	4
PID 1332 wrote to memory of 896	1332	63993ea94de3ce89027c438b773d897e.exe	4
PID 1332 wrote to memory of 952	1332	63993ea94de3ce89027c438b773d897e.exe	3
PID 1332 wrote to memory of 952	1332	63993ea94de3ce89027c438b773d897e.exe	3
PID 1332 wrote to memory of 952	1332	63993ea94de3ce89027c438b773d897e.exe	3
PID 1332 wrote to memory of 952	1332	63993ea94de3ce89027c438b773d897e.exe	3
PID 1332 wrote to memory of 952	1332	63993ea94de3ce89027c438b773d897e.exe	3
PID 1332 wrote to memory of 952	1332	63993ea94de3ce89027c438b773d897e.exe	3
PID 1332 wrote to memory of 1020	1332	63993ea94de3ce89027c438b773d897e.exe	2
PID 1332 wrote to memory of 1020	1332	63993ea94de3ce89027c438b773d897e.exe	2
PID 1332 wrote to memory of 1020	1332	63993ea94de3ce89027c438b773d897e.exe	2
PID 1332 wrote to memory of 1020	1332	63993ea94de3ce89027c438b773d897e.exe	2
PID 1332 wrote to memory of 1020	1332	63993ea94de3ce89027c438b773d897e.exe	2
PID 1332 wrote to memory of 1020	1332	63993ea94de3ce89027c438b773d897e.exe	2
PID 1332 wrote to memory of 704	1332	63993ea94de3ce89027c438b773d897e.exe	77
PID 1332 wrote to memory of 704	1332	63993ea94de3ce89027c438b773d897e.exe	77
PID 1332 wrote to memory of 704	1332	63993ea94de3ce89027c438b773d897e.exe	77
PID 1332 wrote to memory of 704	1332	63993ea94de3ce89027c438b773d897e.exe	77
PID 1332 wrote to memory of 704	1332	63993ea94de3ce89027c438b773d897e.exe	77
PID 1332 wrote to memory of 704	1332	63993ea94de3ce89027c438b773d897e.exe	77
PID 1332 wrote to memory of 664	1332	63993ea94de3ce89027c438b773d897e.exe	6
PID 1332 wrote to memory of 664	1332	63993ea94de3ce89027c438b773d897e.exe	6
PID 1332 wrote to memory of 664	1332	63993ea94de3ce89027c438b773d897e.exe	6
PID 1332 wrote to memory of 664	1332	63993ea94de3ce89027c438b773d897e.exe	6
PID 1332 wrote to memory of 664	1332	63993ea94de3ce89027c438b773d897e.exe	6
PID 1332 wrote to memory of 664	1332	63993ea94de3ce89027c438b773d897e.exe	6
PID 1332 wrote to memory of 1004	1332	63993ea94de3ce89027c438b773d897e.exe	5
PID 1332 wrote to memory of 1004	1332	63993ea94de3ce89027c438b773d897e.exe	5
PID 1332 wrote to memory of 1004	1332	63993ea94de3ce89027c438b773d897e.exe	5
PID 1332 wrote to memory of 1004	1332	63993ea94de3ce89027c438b773d897e.exe	5

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:680

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
1⤵
PID:664

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3896

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4076

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:2212

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:1580

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
1⤵
PID:2564

C:\Windows\system32\MusNotification.exe
C:\Windows\system32\MusNotification.exe
1⤵
PID:3836

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:2864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1784

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:1268

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2284

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4324

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4572

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3544

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2124

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:492

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4124

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4040

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3536

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3372
- C:\Users\Admin\AppData\Local\Temp\63993ea94de3ce89027c438b773d897e.exe
  "C:\Users\Admin\AppData\Local\Temp\63993ea94de3ce89027c438b773d897e.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1332
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3256

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2840

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2668

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2536

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2380

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2276

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2152

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2108

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1176

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1076

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:796

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1332-0-0x0000000001000000-0x0000000001012000-memory.dmp

Filesize
72KB

Download
memory/1332-4-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/1332-5-0x0000000001000000-0x0000000001012000-memory.dmp

Filesize
72KB

Download
memory/1332-3-0x0000000077853000-0x0000000077854000-memory.dmp

Filesize
4KB

Download
memory/1332-1-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/1332-2-0x0000000077852000-0x0000000077853000-memory.dmp

Filesize
4KB

Download