70cb611acd407bb7ab1e6f810914e5812cdf37aa8d9b8cd10181aa5164ee8fcb

Analysis

max time kernel
46s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Generador de Creditos v.2.exe
Size

857KB
MD5

71dd6e0c340bad2b3017a05dd41bde80
SHA1

3f53a5249915d6de24573dab79510066de36fc0f
SHA256

5c5c81d1d2a4032f3757d3c33543cc095ecc78ae4b36239f9072e836efea0410
SHA512

0f86a0d7d569e93e0238a8898bb206b8d60703fb508e0e719f254d21923d566f6572ae6d55a0ac406df1a449cacfd9b98094e5a35236808dbb0d82831d6e276f
SSDEEP

24576:BBekoLMmWj5H8mHIrZX3t8CbyBb26Erdne7e:BBgLMmW18XVX9uAne7

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2960	svchost.exe
2644	svchost.exe
2928	svchost.exe
1584	svchost.exe
588	svchost.exe
1888	svchost.exe
1116	svchost.exe
1148	svchost.exe
1100	svchost.exe
328	svchost.exe
1592	svchost.exe
2908	svchost.exe
2960	svchost.exe
2628	svchost.exe
1544	svchost.exe
1896	svchost.exe
2980	svchost.exe
268	svchost.exe
1396	svchost.exe
2200	svchost.exe
2584	svchost.exe
2768	svchost.exe
3048	svchost.exe
2676	svchost.exe
3032	svchost.exe
1736	svchost.exe
3064	svchost.exe
1628	svchost.exe
1912	svchost.exe
320	svchost.exe
2304	svchost.exe
2892	svchost.exe
2592	svchost.exe
2756	svchost.exe
2172	svchost.exe
2676	svchost.exe
2208	svchost.exe
2984	svchost.exe
2508	svchost.exe
1788	svchost.exe
1540	svchost.exe
1396	svchost.exe
652	svchost.exe
2776	svchost.exe
2356	svchost.exe
2168	svchost.exe
2656	svchost.exe
1692	svchost.exe
1584	svchost.exe
3008	svchost.exe
2020	svchost.exe
2040	svchost.exe
2388	svchost.exe
2288	svchost.exe
2036	svchost.exe
2828	svchost.exe
2920	svchost.exe
2608	svchost.exe
852	svchost.exe
1612	svchost.exe
2024	svchost.exe
2456	svchost.exe
1800	svchost.exe
572	svchost.exe

Loads dropped DLL 64 IoCs

pid	Process
852	svchost.exe
852	svchost.exe
2960	svchost.exe
2960	svchost.exe
2644	svchost.exe
2644	svchost.exe
2928	svchost.exe
2928	svchost.exe
1584	svchost.exe
1584	svchost.exe
588	svchost.exe
588	svchost.exe
1888	svchost.exe
1888	svchost.exe
1116	svchost.exe
1116	svchost.exe
1148	svchost.exe
1148	svchost.exe
1100	svchost.exe
1100	svchost.exe
328	svchost.exe
328	svchost.exe
1592	svchost.exe
1592	svchost.exe
2908	svchost.exe
2908	svchost.exe
2960	svchost.exe
2960	svchost.exe
2628	svchost.exe
2628	svchost.exe
1544	svchost.exe
1544	svchost.exe
1896	svchost.exe
1896	svchost.exe
2980	svchost.exe
2980	svchost.exe
268	svchost.exe
268	svchost.exe
1396	svchost.exe
1396	svchost.exe
2200	svchost.exe
2200	svchost.exe
2584	svchost.exe
2584	svchost.exe
2768	svchost.exe
2768	svchost.exe
3048	svchost.exe
3048	svchost.exe
2676	svchost.exe
2676	svchost.exe
3032	svchost.exe
3032	svchost.exe
1736	svchost.exe
1736	svchost.exe
3064	svchost.exe
3064	svchost.exe
1628	svchost.exe
1628	svchost.exe
1912	svchost.exe
1912	svchost.exe
320	svchost.exe
320	svchost.exe
2304	svchost.exe
2304	svchost.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	Generador de Creditos v.2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometRAT = "C:\\Windows\\system32\\test\\svchost.exe"	svchost.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	Generador de Creditos v.2.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\test\svchost.exe	Generador de Creditos v.2.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\test\svchost.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	852	Generador de Creditos v.2.exe
Token: SeSecurityPrivilege	852	Generador de Creditos v.2.exe
Token: SeTakeOwnershipPrivilege	852	Generador de Creditos v.2.exe
Token: SeLoadDriverPrivilege	852	Generador de Creditos v.2.exe
Token: SeSystemProfilePrivilege	852	Generador de Creditos v.2.exe
Token: SeSystemtimePrivilege	852	Generador de Creditos v.2.exe
Token: SeProfSingleProcessPrivilege	852	Generador de Creditos v.2.exe
Token: SeIncBasePriorityPrivilege	852	Generador de Creditos v.2.exe
Token: SeCreatePagefilePrivilege	852	Generador de Creditos v.2.exe
Token: SeBackupPrivilege	852	Generador de Creditos v.2.exe
Token: SeRestorePrivilege	852	Generador de Creditos v.2.exe
Token: SeShutdownPrivilege	852	Generador de Creditos v.2.exe
Token: SeDebugPrivilege	852	Generador de Creditos v.2.exe
Token: SeSystemEnvironmentPrivilege	852	Generador de Creditos v.2.exe
Token: SeChangeNotifyPrivilege	852	Generador de Creditos v.2.exe
Token: SeRemoteShutdownPrivilege	852	Generador de Creditos v.2.exe
Token: SeUndockPrivilege	852	Generador de Creditos v.2.exe
Token: SeManageVolumePrivilege	852	Generador de Creditos v.2.exe
Token: SeImpersonatePrivilege	852	Generador de Creditos v.2.exe
Token: SeCreateGlobalPrivilege	852	Generador de Creditos v.2.exe
Token: 33	852	Generador de Creditos v.2.exe
Token: 34	852	Generador de Creditos v.2.exe
Token: 35	852	Generador de Creditos v.2.exe
Token: SeIncreaseQuotaPrivilege	2960	svchost.exe
Token: SeSecurityPrivilege	2960	svchost.exe
Token: SeTakeOwnershipPrivilege	2960	svchost.exe
Token: SeLoadDriverPrivilege	2960	svchost.exe
Token: SeSystemProfilePrivilege	2960	svchost.exe
Token: SeSystemtimePrivilege	2960	svchost.exe
Token: SeProfSingleProcessPrivilege	2960	svchost.exe
Token: SeIncBasePriorityPrivilege	2960	svchost.exe
Token: SeCreatePagefilePrivilege	2960	svchost.exe
Token: SeBackupPrivilege	2960	svchost.exe
Token: SeRestorePrivilege	2960	svchost.exe
Token: SeShutdownPrivilege	2960	svchost.exe
Token: SeDebugPrivilege	2960	svchost.exe
Token: SeSystemEnvironmentPrivilege	2960	svchost.exe
Token: SeChangeNotifyPrivilege	2960	svchost.exe
Token: SeRemoteShutdownPrivilege	2960	svchost.exe
Token: SeUndockPrivilege	2960	svchost.exe
Token: SeManageVolumePrivilege	2960	svchost.exe
Token: SeImpersonatePrivilege	2960	svchost.exe
Token: SeCreateGlobalPrivilege	2960	svchost.exe
Token: 33	2960	svchost.exe
Token: 34	2960	svchost.exe
Token: 35	2960	svchost.exe
Token: SeIncreaseQuotaPrivilege	2644	svchost.exe
Token: SeSecurityPrivilege	2644	svchost.exe
Token: SeTakeOwnershipPrivilege	2644	svchost.exe
Token: SeLoadDriverPrivilege	2644	svchost.exe
Token: SeSystemProfilePrivilege	2644	svchost.exe
Token: SeSystemtimePrivilege	2644	svchost.exe
Token: SeProfSingleProcessPrivilege	2644	svchost.exe
Token: SeIncBasePriorityPrivilege	2644	svchost.exe
Token: SeCreatePagefilePrivilege	2644	svchost.exe
Token: SeBackupPrivilege	2644	svchost.exe
Token: SeRestorePrivilege	2644	svchost.exe
Token: SeShutdownPrivilege	2644	svchost.exe
Token: SeDebugPrivilege	2644	svchost.exe
Token: SeSystemEnvironmentPrivilege	2644	svchost.exe
Token: SeChangeNotifyPrivilege	2644	svchost.exe
Token: SeRemoteShutdownPrivilege	2644	svchost.exe
Token: SeUndockPrivilege	2644	svchost.exe
Token: SeManageVolumePrivilege	2644	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 2960	852	svchost.exe	349
PID 852 wrote to memory of 2960	852	svchost.exe	349
PID 852 wrote to memory of 2960	852	svchost.exe	349
PID 852 wrote to memory of 2960	852	svchost.exe	349
PID 2960 wrote to memory of 2644	2960	svchost.exe	255
PID 2960 wrote to memory of 2644	2960	svchost.exe	255
PID 2960 wrote to memory of 2644	2960	svchost.exe	255
PID 2960 wrote to memory of 2644	2960	svchost.exe	255
PID 2644 wrote to memory of 2928	2644	svchost.exe	335
PID 2644 wrote to memory of 2928	2644	svchost.exe	335
PID 2644 wrote to memory of 2928	2644	svchost.exe	335
PID 2644 wrote to memory of 2928	2644	svchost.exe	335
PID 2928 wrote to memory of 1584	2928	svchost.exe	161
PID 2928 wrote to memory of 1584	2928	svchost.exe	161
PID 2928 wrote to memory of 1584	2928	svchost.exe	161
PID 2928 wrote to memory of 1584	2928	svchost.exe	161
PID 1584 wrote to memory of 588	1584	svchost.exe	210
PID 1584 wrote to memory of 588	1584	svchost.exe	210
PID 1584 wrote to memory of 588	1584	svchost.exe	210
PID 1584 wrote to memory of 588	1584	svchost.exe	210
PID 588 wrote to memory of 1888	588	svchost.exe	98
PID 588 wrote to memory of 1888	588	svchost.exe	98
PID 588 wrote to memory of 1888	588	svchost.exe	98
PID 588 wrote to memory of 1888	588	svchost.exe	98
PID 1888 wrote to memory of 1116	1888	svchost.exe	356
PID 1888 wrote to memory of 1116	1888	svchost.exe	356
PID 1888 wrote to memory of 1116	1888	svchost.exe	356
PID 1888 wrote to memory of 1116	1888	svchost.exe	356
PID 1116 wrote to memory of 1148	1116	svchost.exe	33
PID 1116 wrote to memory of 1148	1116	svchost.exe	33
PID 1116 wrote to memory of 1148	1116	svchost.exe	33
PID 1116 wrote to memory of 1148	1116	svchost.exe	33
PID 1148 wrote to memory of 1100	1148	svchost.exe	35
PID 1148 wrote to memory of 1100	1148	svchost.exe	35
PID 1148 wrote to memory of 1100	1148	svchost.exe	35
PID 1148 wrote to memory of 1100	1148	svchost.exe	35
PID 1100 wrote to memory of 328	1100	svchost.exe	34
PID 1100 wrote to memory of 328	1100	svchost.exe	34
PID 1100 wrote to memory of 328	1100	svchost.exe	34
PID 1100 wrote to memory of 328	1100	svchost.exe	34
PID 328 wrote to memory of 1592	328	svchost.exe	301
PID 328 wrote to memory of 1592	328	svchost.exe	301
PID 328 wrote to memory of 1592	328	svchost.exe	301
PID 328 wrote to memory of 1592	328	svchost.exe	301
PID 1592 wrote to memory of 2908	1592	svchost.exe	311
PID 1592 wrote to memory of 2908	1592	svchost.exe	311
PID 1592 wrote to memory of 2908	1592	svchost.exe	311
PID 1592 wrote to memory of 2908	1592	svchost.exe	311
PID 2908 wrote to memory of 2960	2908	svchost.exe	349
PID 2908 wrote to memory of 2960	2908	svchost.exe	349
PID 2908 wrote to memory of 2960	2908	svchost.exe	349
PID 2908 wrote to memory of 2960	2908	svchost.exe	349
PID 2960 wrote to memory of 2628	2960	svchost.exe	291
PID 2960 wrote to memory of 2628	2960	svchost.exe	291
PID 2960 wrote to memory of 2628	2960	svchost.exe	291
PID 2960 wrote to memory of 2628	2960	svchost.exe	291
PID 2628 wrote to memory of 1544	2628	svchost.exe	37
PID 2628 wrote to memory of 1544	2628	svchost.exe	37
PID 2628 wrote to memory of 1544	2628	svchost.exe	37
PID 2628 wrote to memory of 1544	2628	svchost.exe	37
PID 1544 wrote to memory of 1896	1544	svchost.exe	178
PID 1544 wrote to memory of 1896	1544	svchost.exe	178
PID 1544 wrote to memory of 1896	1544	svchost.exe	178
PID 1544 wrote to memory of 1896	1544	svchost.exe	178

C:\Users\Admin\AppData\Local\Temp\Generador de Creditos v.2.exe
"C:\Users\Admin\AppData\Local\Temp\Generador de Creditos v.2.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:852
- C:\Windows\SysWOW64\test\svchost.exe
  "C:\Windows\system32\test\svchost.exe"
  2⤵
  PID:2960
- - C:\Windows\SysWOW64\test\svchost.exe
    "C:\Windows\system32\test\svchost.exe"
    3⤵
    PID:2644
- - C:\Windows\SysWOW64\test\svchost.exe
    "C:\Windows\system32\test\svchost.exe"
    3⤵
    PID:2628

C:\Windows\SysWOW64\test\svchost.exe
"C:\Windows\system32\test\svchost.exe"
1⤵
PID:2928
- C:\Windows\SysWOW64\test\svchost.exe
  "C:\Windows\system32\test\svchost.exe"
  2⤵
  PID:1584
- - C:\Windows\SysWOW64\test\svchost.exe
    "C:\Windows\system32\test\svchost.exe"
    3⤵
    PID:588
  - - C:\Windows\SysWOW64\test\svchost.exe
      "C:\Windows\system32\test\svchost.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1888

C:\Windows\SysWOW64\test\svchost.exe
"C:\Windows\system32\test\svchost.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\SysWOW64\test\svchost.exe
  "C:\Windows\system32\test\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1100

C:\Windows\SysWOW64\test\svchost.exe
"C:\Windows\system32\test\svchost.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:328
- C:\Windows\SysWOW64\test\svchost.exe
  "C:\Windows\system32\test\svchost.exe"
  2⤵
  PID:1592

C:\Windows\SysWOW64\test\svchost.exe
"C:\Windows\system32\test\svchost.exe"
1⤵
PID:1116

C:\Windows\SysWOW64\test\svchost.exe
"C:\Windows\system32\test\svchost.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SysWOW64\test\svchost.exe
  "C:\Windows\system32\test\svchost.exe"
  2⤵
  PID:1896

C:\Windows\SysWOW64\test\svchost.exe
"C:\Windows\system32\test\svchost.exe"
1⤵
PID:2200
- C:\Windows\SysWOW64\test\svchost.exe
  "C:\Windows\system32\test\svchost.exe"
  2⤵
  PID:2584
- - C:\Windows\SysWOW64\test\svchost.exe
    "C:\Windows\system32\test\svchost.exe"
    3⤵
    PID:2768

C:\Windows\SysWOW64\test\svchost.exe
"C:\Windows\system32\test\svchost.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048
- C:\Windows\SysWOW64\test\svchost.exe
  "C:\Windows\system32\test\svchost.exe"
  2⤵
  PID:2676
- - C:\Windows\SysWOW64\test\svchost.exe
    "C:\Windows\system32\test\svchost.exe"
    3⤵
    PID:3032

C:\Windows\SysWOW64\test\svchost.exe
"C:\Windows\system32\test\svchost.exe"
1⤵
PID:1396

C:\Windows\SysWOW64\test\svchost.exe
"C:\Windows\system32\test\svchost.exe"
1⤵
PID:1736
- C:\Windows\SysWOW64\test\svchost.exe
  "C:\Windows\system32\test\svchost.exe"
  2⤵
  PID:3064
- - C:\Windows\SysWOW64\test\svchost.exe
    "C:\Windows\system32\test\svchost.exe"
    3⤵
    PID:1628
  - - C:\Windows\SysWOW64\test\svchost.exe
      "C:\Windows\system32\test\svchost.exe"
      4⤵
      PID:1912
    - - C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        5⤵
        
        PID:320
      - C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2304

C:\Windows\SysWOW64\test\svchost.exe
"C:\Windows\system32\test\svchost.exe"
1⤵
- Executes dropped EXE
PID:2592
- C:\Windows\SysWOW64\test\svchost.exe
  "C:\Windows\system32\test\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:2756
- - C:\Windows\SysWOW64\test\svchost.exe
    "C:\Windows\system32\test\svchost.exe"
    3⤵
    PID:2172
  - - C:\Windows\SysWOW64\test\svchost.exe
      "C:\Windows\system32\test\svchost.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      PID:2676
    - - C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        5⤵
        
        PID:2208
      - C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        6⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        7⤵
        Executes dropped EXE
        
        PID:2508
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        8⤵
        Executes dropped EXE
        
        PID:1788
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1540
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1396
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        11⤵
        
        PID:652
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        12⤵
        Executes dropped EXE
        
        PID:2776
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        13⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        14⤵
        
        PID:2168

C:\Windows\SysWOW64\test\svchost.exe
"C:\Windows\system32\test\svchost.exe"
1⤵
PID:2892

C:\Windows\SysWOW64\test\svchost.exe
"C:\Windows\system32\test\svchost.exe"
1⤵
PID:2656
- C:\Windows\SysWOW64\test\svchost.exe
  "C:\Windows\system32\test\svchost.exe"
  2⤵
  PID:1692
- - C:\Windows\SysWOW64\test\svchost.exe
    "C:\Windows\system32\test\svchost.exe"
    3⤵
    PID:1584
  - - C:\Windows\SysWOW64\test\svchost.exe
      "C:\Windows\system32\test\svchost.exe"
      4⤵
      PID:3008
    - - C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        5⤵
        
        PID:2020
      - C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        6⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        7⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        8⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        9⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2828
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2920
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        12⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        13⤵
        
        PID:852
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        14⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        15⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2024
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        16⤵
        
        PID:2456
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        17⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        18⤵
        Executes dropped EXE
        
        PID:572
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        19⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        20⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        21⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        22⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        23⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        24⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        25⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        26⤵
        Executes dropped EXE
        
        PID:1692
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        27⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        28⤵
        Executes dropped EXE
        
        PID:3008
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        29⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        30⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        31⤵
        Adds Run key to start application
        
        PID:1744
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        32⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        33⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        34⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        35⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        36⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        37⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        38⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        39⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        40⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        41⤵
        Drops file in System32 directory
        
        PID:960
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2020
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        43⤵
        Adds Run key to start application
        
        PID:2572
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        44⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        45⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        46⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        47⤵
        
        PID:2824
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        48⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        49⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        50⤵
        
        PID:592
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        7⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        8⤵
        
        PID:984
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        9⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        10⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        11⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        12⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        13⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        14⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:588
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        16⤵
        Drops file in System32 directory
        
        PID:2384
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        17⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        18⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2768
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        20⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        21⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2212
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        22⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2656
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        24⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        25⤵
        
        PID:948
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        26⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        27⤵
        
        PID:1176

C:\Windows\SysWOW64\test\svchost.exe
"C:\Windows\system32\test\svchost.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:268

C:\Windows\SysWOW64\test\svchost.exe
"C:\Windows\system32\test\svchost.exe"
1⤵
PID:2980

C:\Windows\SysWOW64\test\svchost.exe
"C:\Windows\system32\test\svchost.exe"
1⤵
PID:2960

C:\Windows\SysWOW64\test\svchost.exe
"C:\Windows\system32\test\svchost.exe"
1⤵
PID:2908

C:\Windows\SysWOW64\test\svchost.exe
"C:\Windows\system32\test\svchost.exe"
1⤵
- Drops file in System32 directory
PID:1348
- C:\Windows\SysWOW64\test\svchost.exe
  "C:\Windows\system32\test\svchost.exe"
  2⤵
  PID:1720
- - C:\Windows\SysWOW64\test\svchost.exe
    "C:\Windows\system32\test\svchost.exe"
    3⤵
    - Adds Run key to start application
    PID:1008
  - - C:\Windows\SysWOW64\test\svchost.exe
      "C:\Windows\system32\test\svchost.exe"
      4⤵
      PID:1912
    - - C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        5⤵
        
        PID:2904
      - C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        6⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        7⤵
        Drops file in System32 directory
        
        PID:576
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        8⤵
        Drops file in System32 directory
        
        PID:2272
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        9⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        10⤵
        
        PID:584
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        11⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        12⤵
        Adds Run key to start application
        
        PID:2692
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        13⤵
        
        PID:524
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        14⤵
        Adds Run key to start application
        
        PID:1200
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        15⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1900
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        16⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:320
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        18⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        19⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        20⤵
        Adds Run key to start application
        
        PID:2788
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        21⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        22⤵
        Adds Run key to start application
        
        PID:2832
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        23⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        24⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        25⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2584
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        27⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1828
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        28⤵
        Executes dropped EXE
        
        PID:2892
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        29⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        30⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        31⤵
        
        PID:984
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        32⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2036
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        33⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        34⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        35⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        36⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        37⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        38⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1584
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        39⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:676
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        40⤵
        
        PID:1208
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        41⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        42⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        43⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        44⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        45⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        46⤵
        
        PID:2948
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        47⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        48⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        49⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        50⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        51⤵
        Adds Run key to start application
        
        PID:2372
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        52⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        53⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        54⤵
        
        PID:1104
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        55⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1896
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        56⤵
        Drops file in System32 directory
        
        PID:2764
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        57⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        58⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2804
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        59⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        60⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        61⤵
        Adds Run key to start application
        
        PID:2500
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        62⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        63⤵
        Adds Run key to start application
        
        PID:524
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        64⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        65⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        66⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        67⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        68⤵
        
        PID:808
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        69⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        70⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        71⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1512
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        72⤵
        
        PID:852
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        73⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1516
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        74⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1992
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        75⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        76⤵
        Executes dropped EXE
        
        PID:2456
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        77⤵
        Adds Run key to start application
        
        PID:1796
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        78⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2040

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1936

C:\Windows\SysWOW64\test\svchost.exe
"C:\Windows\system32\test\svchost.exe"
1⤵
PID:2992
- C:\Windows\SysWOW64\test\svchost.exe
  "C:\Windows\system32\test\svchost.exe"
  2⤵
  PID:3012
- - C:\Windows\SysWOW64\test\svchost.exe
    "C:\Windows\system32\test\svchost.exe"
    3⤵
    PID:2544
  - - C:\Windows\SysWOW64\test\svchost.exe
      "C:\Windows\system32\test\svchost.exe"
      4⤵
      Executes dropped EXE
      PID:2388
    - - C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        5⤵
        
        PID:1372
      - C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        6⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2288
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2200
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        9⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        10⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3052
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        11⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        12⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        13⤵
        Adds Run key to start application
        
        PID:3024
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        14⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        15⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        16⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        17⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        18⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        19⤵
        Adds Run key to start application
        
        PID:2624
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        20⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        21⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        22⤵
        
        PID:852
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        23⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        24⤵
        Adds Run key to start application
        
        PID:2076
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        25⤵
        
        PID:688
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        26⤵
        Adds Run key to start application
        
        PID:1904
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        27⤵
        
        PID:472
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        28⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        29⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        30⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        31⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2644
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        32⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        33⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1876
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        34⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        35⤵
        
        PID:592
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        36⤵
        
        PID:876
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        37⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        38⤵
        Drops file in System32 directory
        
        PID:2164
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        39⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        40⤵
        Adds Run key to start application
        
        PID:2156
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        41⤵
        Drops file in System32 directory
        
        PID:1972
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        42⤵
        Drops file in System32 directory
        
        PID:608
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        43⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        44⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        45⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        46⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        47⤵
        
        PID:932
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        48⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        49⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        50⤵
        Adds Run key to start application
        
        PID:2332
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        51⤵
        Drops file in System32 directory
        
        PID:2520
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        52⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        53⤵
        Adds Run key to start application
        
        PID:2292
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        54⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        55⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        56⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        57⤵
        
        PID:948
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        58⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        59⤵
        
        PID:812
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        60⤵
        Drops file in System32 directory
        
        PID:792
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        61⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2980
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        62⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        63⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        64⤵
        
        PID:584
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        65⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        66⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        67⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2628
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        68⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2608
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        69⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        70⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        71⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        72⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        73⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        74⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        75⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        76⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        77⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        78⤵
        Drops file in System32 directory
        
        PID:2868
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        79⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        80⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        81⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2208
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        82⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        83⤵
        
        PID:836
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        84⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        85⤵
        Adds Run key to start application
        
        PID:2540
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        86⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        87⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2908
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        88⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        89⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        90⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1624
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        91⤵
        
        PID:332
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        92⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        93⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1628
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        94⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:852
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        95⤵
        
        PID:2080
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        96⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        97⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        98⤵
        
        PID:988
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        99⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2984
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        100⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        101⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        102⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        103⤵
        
        PID:896
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        104⤵
        
        PID:868
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        105⤵
        Adds Run key to start application
        
        PID:948
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        106⤵
        Adds Run key to start application
        
        PID:1932
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        107⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        108⤵
        
        PID:240
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        109⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        110⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:652
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        111⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2928
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        112⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        113⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        114⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        115⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        116⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:3032
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        117⤵
        Drops file in System32 directory
        
        PID:932
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        118⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        119⤵
        
        PID:700
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        120⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        121⤵
        
        PID:688
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        122⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        123⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        124⤵
        Executes dropped EXE
        
        PID:2356
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        125⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2960
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        126⤵
        Drops file in System32 directory
        
        PID:1068
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        127⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        128⤵
        Adds Run key to start application
        
        PID:2880
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        129⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        130⤵
        
        PID:2068
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        131⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        132⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1116
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        133⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        134⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        135⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1912
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        136⤵
        Drops file in System32 directory
        
        PID:1868
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        137⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        138⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        139⤵
        
        PID:776
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        140⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:3064
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        141⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1612
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        142⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1736
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        143⤵
        
        PID:2080
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        144⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        145⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        146⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2168
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        147⤵
        Adds Run key to start application
        
        PID:2824
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        148⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        149⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        150⤵
        
        PID:816
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        151⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        152⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        153⤵
        
        PID:964
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        154⤵
        
        PID:888
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        155⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        156⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        157⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        158⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        159⤵
        Executes dropped EXE
        
        PID:2172
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        160⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        161⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        162⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1948
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        163⤵
        
        PID:868
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        164⤵
        
        PID:548
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        165⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        166⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1208
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        167⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        168⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        169⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        170⤵
        Drops file in System32 directory
        
        PID:1748
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        171⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        172⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        173⤵
        
        PID:764
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        174⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        175⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        176⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        177⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        178⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        179⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        180⤵
        
        PID:368
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        181⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        182⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        183⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        184⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2628
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        185⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        186⤵
        
        PID:764
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        187⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        188⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        189⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        190⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        191⤵
        
        PID:700
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        192⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        193⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        194⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        195⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        196⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        197⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        198⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        199⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        200⤵
        Adds Run key to start application
        
        PID:1352
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        201⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        202⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        203⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        204⤵
        Executes dropped EXE
        
        PID:1800
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        205⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        206⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        207⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        208⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        209⤵
        
        PID:904
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        210⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        211⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        212⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        213⤵
        Drops file in System32 directory
        
        PID:1456
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        214⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        215⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        216⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        217⤵
        
        PID:700
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        218⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        219⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        220⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        221⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        222⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2200
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        223⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        224⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        225⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        226⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        227⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        228⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        229⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        230⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        231⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        232⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        233⤵
        Adds Run key to start application
        
        PID:1616
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        234⤵
        
        PID:1540
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        235⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        236⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        237⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        238⤵
        Adds Run key to start application
        
        PID:2892
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        239⤵
        Drops file in System32 directory
        
        PID:2352
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        240⤵
        Drops file in System32 directory
        
        PID:1968
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        241⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        242⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        243⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        244⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        245⤵
        
        PID:2976
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        246⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        247⤵
        
        PID:996
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        248⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        249⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        250⤵
        
        PID:1808
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        251⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        252⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        253⤵
        Adds Run key to start application
        
        PID:2324
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        254⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        255⤵
        
        PID:1168
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        256⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        257⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        258⤵
        
        PID:2976
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        259⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        260⤵
        
        PID:2368
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        261⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        262⤵
        Adds Run key to start application
        
        PID:2544
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        263⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        264⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        265⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1632
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        266⤵
        Drops file in System32 directory
        
        PID:2512
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        267⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        268⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        269⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        270⤵
        
        PID:776
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        271⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        272⤵
        
        PID:996
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        273⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        274⤵
        Adds Run key to start application
        
        PID:1988
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        275⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        276⤵
        
        PID:2648
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        277⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        278⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        279⤵
        
        PID:848
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        280⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        281⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        282⤵
        
        PID:2976
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        283⤵
        
        PID:896
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        284⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        285⤵
        
        PID:996
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        286⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        287⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        288⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        289⤵
        
        PID:112
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        290⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        291⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        292⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        293⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        294⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        295⤵
        
        PID:868
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        296⤵
        
        PID:616
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        297⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        298⤵
        
        PID:2068
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        299⤵
        
        PID:752
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        300⤵
        Adds Run key to start application
        
        PID:2108
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        301⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        302⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        303⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        304⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        305⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        306⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        307⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        308⤵
        
        PID:332
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        309⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2264
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        310⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        311⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        312⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        313⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        314⤵
        
        PID:2648
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        315⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        316⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        317⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        318⤵
        
        PID:1168
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        319⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        320⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        321⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        322⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        323⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        324⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        325⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        326⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        327⤵
        
        PID:112
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        328⤵
        
        PID:108
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        329⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        330⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        331⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        332⤵
        
        PID:692
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        333⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        334⤵
        
        PID:1268
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        335⤵
        Drops file in System32 directory
        
        PID:2620
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        336⤵
        Adds Run key to start application
        
        PID:2332
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        337⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        338⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        339⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        340⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        341⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        342⤵
        
        PID:848
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        343⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        344⤵
        Drops file in System32 directory
        
        PID:2780
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        345⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1596
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        346⤵
        
        PID:1392
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        347⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        348⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        349⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        350⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        351⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        352⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        353⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        354⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        355⤵
        Drops file in System32 directory
        
        PID:2396
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        356⤵
        
        PID:1168
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        357⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        358⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        359⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        360⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        361⤵
        
        PID:996
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        362⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        363⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        364⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        365⤵
        Adds Run key to start application
        
        PID:2400
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        366⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        367⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        368⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        369⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        370⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        371⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        372⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        373⤵
        
        PID:1324
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        374⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        375⤵
        
        PID:652
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        376⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        377⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        378⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        379⤵
        
        PID:436
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        380⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        381⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        382⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        383⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        384⤵
        
        PID:876
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        385⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        386⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        387⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        388⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        389⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        390⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        391⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        392⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        393⤵
        
        PID:548
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        394⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        395⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        396⤵
        
        PID:1008
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        397⤵
        
        PID:592
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        398⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        399⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        400⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        401⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        402⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        403⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        404⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        405⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        406⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        407⤵
        Adds Run key to start application
        
        PID:948
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        408⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        409⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        410⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        411⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        412⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        413⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        414⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        415⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        416⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        417⤵
        
        PID:932
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        418⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        419⤵
        
        PID:328
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        420⤵
        
        PID:1540
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        421⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        422⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        423⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        424⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        425⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        426⤵
        
        PID:368
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        427⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        428⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        429⤵
        
        PID:816
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        430⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        431⤵
        
        PID:436
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        432⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        433⤵
        
        PID:2368
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        434⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        435⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        436⤵
        Drops file in System32 directory
        
        PID:1732
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        437⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        438⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        439⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        440⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        441⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        442⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        443⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        444⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        445⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        446⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        447⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        448⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        449⤵
        
        PID:2516
        
        C:\Windows\SysWOW64\test\svchost.exe
        
        "C:\Windows\system32\test\svchost.exe"
        450⤵
        
        PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\test\svchost.exe

Filesize
418KB

MD5
c5ec20ffc2ce73ee7b7fb67ac108fe4c

SHA1
1b2a290b126ccb21045063538e7afeb78a1b521d

SHA256
6c55acf63d5b86b55c60f27618228da95137fb0c8e09153eb5f990a49257c572

SHA512
03e65130d14e0901c6628121a77c1573dc741deb14f1969a5d3e249e7f9b5cb596156056d024138f87ac087d83d0f81371760640ebf4caa31f59cb57a4278c85

Download Submit
C:\Windows\SysWOW64\test\svchost.exe

Filesize
42KB

MD5
1ab0feeffe3b5fbffb4f3e765ead6c95

SHA1
d833e958895056babc5047131572f69ee9bf859d

SHA256
de0a6918d75cd9430ed2c1fe00e84e6f641124d3e473c8be969ee17c790382c3

SHA512
ce352d18181c515fa58b609d95ec543e8b89a015293e1d656359af3b81ef8fadbb55bf66e375d47127cb34e6f80d74c884c17cd17907f4c3c4b0f24078df19a0

Download Submit
C:\Windows\SysWOW64\test\svchost.exe

Filesize
92KB

MD5
62ae26803c334cf8da2921d9ed68c5d7

SHA1
bdcdc1dc4e002ffdb38432d31def5362b69f67ea

SHA256
f68c3f6e33c336ecca4d7a0c47a9da71dd5e471712e1b8ca66a547a6b97611b9

SHA512
a9102fbf86fdb95acbac40d234de9ebf84007ee3e2992b91330ca69619b3150851b2af8bb9df4e9404548502cd3c4cdd145ea1d270efeb33c24bc1740d3da6da

Download Submit
C:\Windows\SysWOW64\test\svchost.exe

Filesize
64KB

MD5
ee21ea9f4c90c65ff14613a49f01a080

SHA1
8b656d9cb938e9185e57fa13470599f2960fe01e

SHA256
340abd9827d35c9b5b82aedce9ecf5a026217021d25f735cc667de9d710fa63c

SHA512
ae5e1b0511c7b7b9d126fa7cca64386bd9303d85b832f8af1be1092c0001e32a9868d27f06da2d62ad1c19cc7a6d8d1b20e5a7d73093aa1c7871adc68d9e78a2

Download Submit
C:\Windows\SysWOW64\test\svchost.exe

Filesize
138KB

MD5
47955c3e96f123abe8d0e175d139f552

SHA1
31f3b6dbaf90719c4d75e3e4a3b0292eacd6392d

SHA256
5321d0be4128b8b0f486b0d18b0ca06642489992ac7f9752a66b98a602bbc483

SHA512
b2dc25f137d6821d2cc3512c6a0de02378485961a34a857baaab7ef08d0fc65ab2b96133149fc702ee6c6e10f107eed02c4c679fec23b5e95e4ab2e64aa0f524

Download Submit
C:\Windows\SysWOW64\test\svchost.exe

Filesize
67KB

MD5
c6c56fa1d8e5b378bb75414c44c34d55

SHA1
ab3e48a73ce5f65fbe37b97bc48f011dfabea9a9

SHA256
78341235fd335c58ce0f6e1d2730a9a4f34c545c6b25a5594bbe751540f4b90f

SHA512
4511b0b65329c8e6bd5c6964ca4f654142d6f0f44c46e30b7731861200927cd2c4b045a9fb198c93d19549e079e26ffbf3602b5501461f1cf89278b7a93a3865

Download Submit
C:\Windows\SysWOW64\test\svchost.exe

Filesize
31KB

MD5
83cc5cdc43dbf33c92923cf99f98cf3b

SHA1
421aacd8e9b9f7b0e1328f6825557ab2cb557382

SHA256
3fb00e8a2c855821d7c13239651fa8409fa4a0fb93ba2cf413eae9ea60f10e9e

SHA512
95de31381d87ed679358801684c081c3882516cfdcd2ebadd15ea352e15aea9d0a58d26c08e0da52d8a50f6227e319c27e88d7afce2d11d59194120ef2c851f7

Download Submit
C:\Windows\SysWOW64\test\svchost.exe

Filesize
182KB

MD5
9dff8f5b3edc571e29c971552c0571b9

SHA1
8f3bacc1f5ef71dfee984706b0d99e1fe7e4042a

SHA256
bf8fe6f63a6305330849b91629e838e20a56a414a73cb4c5a7e015dafc9912dd

SHA512
b903ca89062d1985fd777f3971f1b84ea7f24c53890f50f1e2e458865ebbe7cea8838fdcf894603ae2daf38d44883c54a78b5240b89cd41d51cfca24219f50ee

Download Submit
C:\Windows\SysWOW64\test\svchost.exe

Filesize
144KB

MD5
2374a0653b5f8fdbcae66faffa662d9d

SHA1
b47dc8f9f0843768146f3ae2f7e1375ba87ea7d5

SHA256
b05fd5f68ee5e589d250f8f202228f73bba301f9ce28a45203fc4b37ffda6db9

SHA512
a151edea02966a1c2ba68739e1897241646f5eb307e9bba04b56eebccba2f2e45ea534f51ae2aeffd70673034a47ffe4eb3ddfb4efe754784f1cb449c9dd28c5

Download Submit
C:\Windows\SysWOW64\test\svchost.exe

Filesize
29KB

MD5
e7614510fd839a6d7dfb18280db3a722

SHA1
cd1676adb8a0e2d69959882c2d0d34ae13f15284

SHA256
51a1bae573bc10b486231ab7770a1e801a44b2488bb763f4fff77aba4de448f7

SHA512
bd458b13ac69d9baa50368cc2fa7e3de658f8f7789dd028076cd3c9cb6427182dd4cf65b3293a5184b23c513b9e6e3780a096e85752c18050ace64778d3681d7

Download Submit
C:\Windows\SysWOW64\test\svchost.exe

Filesize
147KB

MD5
4fc90cfc3f00286f8334a25e6cc44b06

SHA1
ee22459748dd2db66eaa1af91e4603bda112c3c9

SHA256
a6688073db622145ffa9f467a03ba6a98ea8a7babeb631ea80c2bfca6f7a18eb

SHA512
e6698c514684572e651d8e5ba93cf4029ca47fdd50ec8d24f4a8083e90870564ace8b77f52d89d355d091461ff791271517c8ed57bd1c2940dc3952933e08787

Download Submit
C:\Windows\SysWOW64\test\svchost.exe

Filesize
140KB

MD5
1468cc507ecb78b69304ec4979c84f79

SHA1
f2de94335eb2d0f9d6148da407240af0af9ab18f

SHA256
2f1ec71531022c4b1140aa5ac7d3e24eb518947a9af0b0e34a36ebadb82c11fb

SHA512
9369fd8de121b52264476a55f439d9896d28ba83e1ce6447522c7d1b787c3ea67cda49b1911b121ffe8b2c554d2cdcf3ad5aa5da4f266f521e102ace06c07f83

Download Submit
C:\Windows\SysWOW64\test\svchost.exe

Filesize
53KB

MD5
abe6bb46e3becd37d33379eac20e515c

SHA1
a8d7d2b15d4ebb54b9c23d3597b46f6a559ee3a9

SHA256
ccd56df5eeb48f50ec0eaba000feb4a014f0507fd2a359946230ad1c71bf4998

SHA512
df26a6bbdf88adf1522ebbe50524d92a02d5bc2758b64beb8c4e000831baee2825a797611660b3d86a3c8b1e0904af41621300ea89dff227a0f9520f1f0100be

Download Submit
C:\Windows\SysWOW64\test\svchost.exe

Filesize
136KB

MD5
35f278d881f7d7028f3e0cb22be38717

SHA1
22cfc67d1803f89015c3285039a7b9463832efad

SHA256
665aa3b29463e0b623dd27d4fe25e4db241bc5101313a38c7ff7389a7e4b031c

SHA512
cddc25538ad07c96780604b42484fed617a94db73fc1c7cb5eb60e6e9caecac3874c49e3eeb376bc7f39c3be2fd2f822212416107ddbfe7e59ee4a1282a64616

Download Submit
C:\Windows\SysWOW64\test\svchost.exe

Filesize
67KB

MD5
16fa70d0c463e85f86ac9509687cdc0d

SHA1
64564f6c80f3018ef6f34e1c3f2df3423c0b7114

SHA256
d0cee6b0a1c16e10523d91a81497b6e530c25322077870c2ac4add90c3e5dddb

SHA512
3433428f61f1a72b948214626e47540a270ad649499509ffe821f5a9ba5ff9605ff61516c42c472dc3a3ef70fcc8c23b610c4147cc0132fd07f8dfc8c382b35c

Download Submit
C:\Windows\SysWOW64\test\svchost.exe

Filesize
1KB

MD5
dcb47ceb4e7b3e6bea0d1120621390c5

SHA1
0fba3a4905ee5f7e4d3e85f89a0cdca6fd654e25

SHA256
adb742ae10cf1748d7adcc82d98b40c579ae6d8056a3898b0657ffb64c82d83d

SHA512
22b7647c9f7d63f41079ce9b6e92e94a76f2304186bcbcecea6456ea02a23d64c0ec15b3c4b2c0c6f669328e4157d8069c8acba151a350ac55e10b3a8358ae57

Download Submit
C:\Windows\SysWOW64\test\svchost.exe

Filesize
24KB

MD5
f9f0cf7c97159a2277608eac53c32927

SHA1
930c56b94c6b9104aa5326d8c002ea75ef30b348

SHA256
be12ce764c5a530675c274b4347780f32373049cf0778da92e3e92f6bd658a12

SHA512
6c358603a5a44155862a887f7b9e94ff56ffb7c4e672de9ca1131cc623f971c3f02b726d817bc67437ea15be57dadc01647430a9fb9c54df71ebf93e5a8f2562

Download Submit
C:\Windows\SysWOW64\test\svchost.exe

Filesize
54KB

MD5
9c55f319976fd1b9d11eabb103b42642

SHA1
28608320f0115f2f82186f2911ea6420b3925951

SHA256
5232eaa547e9f7d85783cfe5dab4a74ecf4adb0b6964ca0001647057c8dd78ed

SHA512
88d2c8cf35fbdeef0b30210523600c251eb806c0d61dcd6a773e1cd2f1800ddd82291250cf347d971ced240864dd12261499cd39f36e0deb5f401ca3322c12e8

Download Submit
C:\Windows\SysWOW64\test\svchost.exe

Filesize
369KB

MD5
44a4836c197c259b0443754770f8db3c

SHA1
381b943e228bbae6d07f9e23629e4670de35c8b4

SHA256
3aac29e6c65257372d26607b988496de27d29c0f14996edefb4680ccf2296d38

SHA512
f6ae43832312c0fbee9e862be11841051328ac9434e191aa85fa787a8aa56d4d40c73b21f5525f20c0973a2c23596b1916b6d5d1dda8fc64d9d14a242f6338e1

Download Submit
C:\Windows\SysWOW64\test\svchost.exe

Filesize
100KB

MD5
9cfb62686572c63f216b3c79cc752755

SHA1
e389f9cba3beb9a841d8f54acf8795e9b7312c2e

SHA256
f702f792bb15198eca52750c39cc21b0df17c52b2d285213d0099de248a61c2d

SHA512
c1ed118dd72eeeafc2c6e19038fb9f9cb206de5b0a56bc71431dac2e51f2ecb918f22f8642502ecffd3b8b17bf0bd070cb76f5f3f40f026379dca15038c595b0

Download Submit
C:\Windows\SysWOW64\test\svchost.exe

Filesize
101KB

MD5
e07cee3983ec348305368a9c8deecceb

SHA1
f6f81983572c4cab14d443a12605772766b572b0

SHA256
670fe39d0fcc921840aa6a7aa655d0b87ac33e032aba0f9ad6c0a324290c2f78

SHA512
33429cfda4f2ba1f6fcc75827d109dbc92c6476c6aff2bed54e4a506ab348cdfe9854e26296ec7c52f46e18dcc2807d33c6098e63980b84532f353c16fb02538

Download Submit
C:\Windows\SysWOW64\test\svchost.exe

Filesize
82KB

MD5
142ee19fe41a7d21ad51902be2d6eaa8

SHA1
916a1d22f59777b662b6ae7ed677cdae55609ba3

SHA256
b9071092d9b5f628dc85e6ffec22e1835da28f19cc47736139ab79ffde363d9c

SHA512
6327a7d0b85a23902dadb8814e7675bf2e6a27d88c60ce2a1942f024fb71e7a14a2e96f19976578e59b04a7122652fa75357166f5f55ab97f847c67b793a6f4e

Download Submit
C:\Windows\SysWOW64\test\svchost.exe

Filesize
101KB

MD5
2fb0d8d8cd771206cadadd0d781a8ba5

SHA1
09491d10fb54e76a65536de9af6a0194536755b8

SHA256
4901281ad6efa1b8d282901045b7444c0b7c6c61d69fd6eee096091c5ef0a3f6

SHA512
84185be8d841c5cc43a3e7c1c94c9fefafad5a25fa6e9664c0bb9c9764b59e40200f9c802bfbacd7b695817c17394ecb85b165132d2245c20c597726c925352a

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
290KB

MD5
61174cc1067e32d60ea1a62718c8e076

SHA1
7377c3bd794154e6a13e28701c3b43908c0f422d

SHA256
1e0703263af86efa289e0f094216e91800c22f20c5f0aa630e5973954456b882

SHA512
6117efe14b604ec4d323923ad35f1cbb2db7cf27c4445f5e61251278ab2a2d09af6b2409ff5cedd268ac458c9055a22874deecb8a340e3fe9e29b3b347552b66

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
129KB

MD5
407e2059d55712381dafc5274a39a62f

SHA1
837a2efa54ed77daefcd299e2b2dc387cc21f4a6

SHA256
b3278c7932793cc6fef801385f379fb7d7e33ba54bf22e29b3383df202a04ad9

SHA512
aec8b30da057ab9124d18386cf11370347a97dcec57e0cd2a0c523a20142b44ac58a3c804d1b28852348cfc93844d1d9ad212ec730398c9e87d3d06e474990f9

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
129KB

MD5
a6b010b3e85bde679d0398227b68dfdc

SHA1
3611cbd9b8bbb46d59b4758405e7105e1383b19e

SHA256
976d37b3eeb362443d8f6f6583a6da51cffcf01497cbcc5a96639ba761da5922

SHA512
034a5dbba974d8a748e23e5aab796b85ba49509422074642526eae29d6bcdc8be84ca0ff6779ae870dfc9305f4a00d639f6a28c2d023744f78948a00b40008d1

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
76KB

MD5
e8b33fa268ef56cae0864cc9d2e6b847

SHA1
5abbabc1959959056cea11e887a8dd277194593f

SHA256
e74379daab42dce1a5cc4f1cf525190bfb03d8ee0a7008e747481eb604e28d08

SHA512
5044365a3242f503293a3ebaab561d051b7abe4c7fe8eba05eced74253f12c2eb3c79530b9e6934856d5c0ec339b127b47f038248bc95709bc238272570e78f2

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
40KB

MD5
2ec5cc4d770d34d5fddd71f42bcd9cac

SHA1
96ff2c54c04d371309723ebe94fe82789081bd3f

SHA256
24302a1552066fc0d6c86c4e6088e8f59665c71721066e69678d6258a3e37400

SHA512
822932f83eb2d7744d4b9d8ff15118941af5af1eb76d1c5c17ebd0e56604bf51d22e243c82699a3e8341e94dce51d035bd0c71f4c40280deceb0f6d73d9a6636

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
18KB

MD5
6c52406a3d3976ae1f3319cf81c296be

SHA1
91ffa4663bff43ad934bf8313016ebfb2e552314

SHA256
b353130a574341a79c84732f4fe17fdd255ddf417e8bd229f517f32d46fd4c35

SHA512
5e6e2f6d5dd4315d734be8e19f00e8e8ef1e4b91216bd8ac2c2eaa8f30e881af38c3b6bf6cbd4205a6017042330deb57d576b1bbc97bd9fb7445195b0af8dec9

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
45KB

MD5
851138b694cb0f98d251fd433b502dfe

SHA1
8f4c866ff74ccfdf2360909d5624d042ab7e8eca

SHA256
3b64980d49b4744384af02611bddb197286b695c9d07b80b694935b6dd125d13

SHA512
616cafdffa081b49065db7bf923c84cc18782f9678fd2bbf6411e045f7b77ca2d3494ad976f791ba47f1895bf51eea4a345cc61a962be97f2a19473d3b7d8339

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
123KB

MD5
4aa79aa97329b867e919944c03bb8011

SHA1
9d85415fc17e37444f95820919bc240328d137e4

SHA256
9139d8bdb7d1032f520b2d2a6c88f0f7532dfacad84a42f2ef347e20f181688b

SHA512
edaebf0b6cc937f4c9b583f54ac920f6c288c98095b2ebdb8328d846805880794ac6f76e4fe09b63d4416d8d23a372b2e9ee6bad0872befaecacda7aa733fcca

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
17KB

MD5
19b6f95533965e642f65ec2bb75be112

SHA1
c07074d096caba6700bd6f28ac9904f7bbf5d988

SHA256
1d176a6fa9e6483863ddbb80cd5237a81712037347bf3998e88b305b924875bf

SHA512
846e807a6dbb65472ee806f97c92df326737801d953fdde54ba2a2d53e023fecb24f57982a742a42afcd322dd82f08fe7c8ffee99d3814690b5c0f4500a546b3

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
52KB

MD5
f882e5a3b24cf1ec972b4d3d9b8002de

SHA1
4ef575cc19988af14bcc21d7307bf0e61f614c3f

SHA256
75fe710bf552aacb83bf05f47a75bc0fd91ca7ec78c718e19d740ce5b929678f

SHA512
768b07b5528e2dc068c10daba471eea95047a480a363b02efbe37359a7a2dbe15d99914f5d0e071910e30e9915e3a43963d52d9e25734fa6185dbeb1e0e03b9d

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
210KB

MD5
edf169ca36abddfad74b5d3c8a152254

SHA1
10e81e5f2f9ea356e68d21249e651fbd3a5832ab

SHA256
bafc74044658cfd3aabffbbe63080beaef49454ee07d849d7399b6feb681db64

SHA512
36e60abf511412b8c231fe9f942f2f9001f61e866b3826729775878c323030c8db808232b6562b223f8cf0e32f094bb6b42402464c2d77b3b5d5f2ddf0576e89

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
199KB

MD5
faf9c899a935c203e524bd4b088563ca

SHA1
c53b256613ff5b2a4bc83d0747c256c66c33867c

SHA256
2833b399b4cc500220fb869b32da2fea20d4f52361b3ca92df09848bc96d2381

SHA512
84b3dcfb9eb44402e1c12ba8c862e41cef48fc41765321d61bf9b76248f3053f30b99f7f76189b2901b2cbc4aa6b1498b9fb4d310982ef6bafe1d83229a592b7

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
171KB

MD5
714219411a70485c2279d41b9d8c5e4d

SHA1
589669060a7f76e1b6cfb994ea397fc9b5393c18

SHA256
61654be71d23473fc3d3170221281acbc1a8a926a8b9307693bf9595409de337

SHA512
103b17f8ace21222dc4fdfd3a2cd6a445fb047f32023f1fc2cbadff28614178b46aac9b2a16c98f16f6184f8edb75f8927602beb46cb47f7716b266e41000f3b

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
126KB

MD5
443b8984208a0bf303925173f3438f6b

SHA1
3ce8529dd571ac5267b726fa1768b13c08d825ea

SHA256
5acf8d7f59c769702d760b6ec09902104dcfd6b7ce1680076b4a66ec5df0704e

SHA512
b3b976926836c0ff31b2f179e5c7701b0c730ade01b2eb390652123a4ad8534c3f78f59cd84f7dfd4a1e43c0d6ea0e40d87adddce2e2100e4d43446e1e109df7

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
23KB

MD5
0c31762a14ed3a674dace06f3e73dfdf

SHA1
a4359506aa6a940f7ea7eaa26cf499428a3d3cb3

SHA256
d417316d009ef410d2e26a9acf6bb0f7692ab08b0e4c8bcdd96419d8585c7180

SHA512
4e6a51b5a939f86189bb6d0c8933ac648cd66e54b217cdb18266fb1fbb1230ad7888c39c4a46a056b210cdf57e788d5eea6afc616b8ccc5f6e3a624fb6d6c593

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
34KB

MD5
ddce4ee3c66832f0ed06e311c5d64deb

SHA1
62e8af0921f8ab385bc29094c5a3dcaddd08422b

SHA256
823e230a463f05e3654b098d2e1a53b5123f00ccf1469ff92ec4729614762856

SHA512
a3e5c68ac90d863f428f69db8e6b5b7f8b152151550be580742a1eb685404d4e453c7801e40d4e7035916ddfaa887baddfcb6f71e3556ae9b1a258ba089eecd2

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
218KB

MD5
e9983283b09fbe22d7fbe15558a16dd5

SHA1
9e60f6cb071b4ed64ea89de5d0177d68856de84a

SHA256
776549c347c7750a13fb5ef46d90f583ef4ab844016657306a8470d136f5ae4d

SHA512
52b7cdc061c60d24fa8ad513d0ac769c1d423a294fa3c92feda40c56ce91c6301cffd5823a1bcc592871ed8e8df8e2cbb8d16b389874dc5bdadfa6bbe0474a4c

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
278KB

MD5
49aba8799c307e39ad73082ccaf29570

SHA1
dad99b8da2601456c64ef05740d503aef47c81ea

SHA256
9e6313de91ea9f654cae655c22e13bccb59eda0b49e69f5a1d455eef3a8223cc

SHA512
70d24281cbcb59544af27272956a3748f45b7b0abdff164397a14aeab3a85443f78b874d27a4c5b8aba5519736a60d8de94b231c75eb2f21321159a1f20c6436

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
86KB

MD5
c6839f961340f28cee4f5cb9cf28406f

SHA1
9816653ef629c14a3ba7d6e93b8f18cf3185323a

SHA256
45d473c8d6e2e5676106f41b98228b3d293eff614cb7f2e76602298e642e69fe

SHA512
2daf81a78aa3719bae0a2379cc35ff5fc9315cd6e7ab631b3785f83c7eaac1c2480b642bdd16437ccfb5239ba4ce3a3f11bec853187b7c7f530772a82a99dcf3

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
857KB

MD5
71dd6e0c340bad2b3017a05dd41bde80

SHA1
3f53a5249915d6de24573dab79510066de36fc0f

SHA256
5c5c81d1d2a4032f3757d3c33543cc095ecc78ae4b36239f9072e836efea0410

SHA512
0f86a0d7d569e93e0238a8898bb206b8d60703fb508e0e719f254d21923d566f6572ae6d55a0ac406df1a449cacfd9b98094e5a35236808dbb0d82831d6e276f

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
770KB

MD5
7c269e177d86861f4de69cb8fe4d8802

SHA1
78fbc8f2f0e52ec86253132b6c41e478dc5012a3

SHA256
209df5680d7ff9c2b51f2b1ad6eea9962cd57acddfaf853f3682039a360843f3

SHA512
1be0924d8dc1cfd24553e7c89f8a93f524ad392589e7d2c204867ebdaeed1d52873061e6dde63fdd6807a7300e448f8e7c87267ed18ccf4650f5759c09434eac

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
345KB

MD5
62b6a60379ab5878d479b54e04856d48

SHA1
2ebf646f46a311cb7fee337cadc54781f28c1ca7

SHA256
8dd1ea1eb61cbe515b1b48c1540a8bbdce5be9deec6314f291b1144ca2737a21

SHA512
187a69066ddb0dea68d2f57aa998ada2dc67e0e6254a68b7dace0cbf48757ae71fdc7b963a265338d793198920cd3ec43bb1d9bdbffba704ac820fdb48c04e14

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
270KB

MD5
3edf0deafe8c2553e8122fee841a0f26

SHA1
a00a6422af0276d17c970637f728704c84dbfe79

SHA256
2001c42d63184c76ea6d36cd97f61b9e7e9db8f2f7d452cef10fd03684d9801b

SHA512
7c7af08854c78fa8bdc9ac71a79f7a31d5759fadce8cfcd235d744e90e58cd8fd4c30b71ba523ce7a98f9496eb37e9aa275a309e5aea0b10465ec82894336a66

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
94KB

MD5
638051bf04c0ece39e59d7d26f26483b

SHA1
673b59fd668b9039ffb2a6fba68a6131d9e7a5fc

SHA256
829e6ca4e26f059bd705f9fac7fa3fe2eed815d105ee2518fed3fbeaab6b6a7f

SHA512
fa7a5e7ae15dd9e127e150c597811fbc5465d97fe9db463759275c57977f5bd44eac24786ea6c486dc5ff3d8b8617a0d3ceae5f5d738edc35d8e51acba6e2f63

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
331KB

MD5
39a6b89311af279da05da68c09c4710e

SHA1
6ce9053f1fed6b14f34b7b58d2e02bc6403dc2cc

SHA256
f896bae55e55f795859dc0fa915d49022e9bc4fd409cef59aa398a5baee9eb07

SHA512
6dbfaf43e85ee3a573b42ff15d567276c3a1d147b9a1f0987370ece105bcfe5eb200cba37dd2467d25a4987d4009acb87234f13499c7f957eb3161ac815f6779

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
61KB

MD5
7db8aa57f9954788398298321ffac209

SHA1
07ab20bcac83a8b2bea44edd79da3e29de5c4d13

SHA256
d73a9154cf05e8ca85b17de6e870d6a91bd0402b824f06f4937e38bb23c1134d

SHA512
b49540c0c719a0ece4546cd507f8e9c11c74373d7adf284705d0cc76c3a46bfc2c5a408ff5a8bc096e77ccef048a86d37abf015a70cc4026c945314b9e0e439f

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
9KB

MD5
579e497578dcbf6a54002e6829864b60

SHA1
703ee43f3735eca1b688e87feab3cc01af68e616

SHA256
dbe024d86b0c209fe9a475540adeb2d221bb1fc30141c5e0dcac5a5c1d93cdbc

SHA512
e35f9170add670f90c0794393934baa4f772a3dc4fad18bcaaef40c557481c53d3beb93fd983213c0c551600549187a92ad44f68469f9cb86af6b4ee7d13427e

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
341KB

MD5
2c5d288d564310de26048058e3334871

SHA1
e3dcf20193bf675b6c4bc384775f293a6c84852c

SHA256
8e1587fdff4306332ef08d4ed38fa7a877612600a35879d37ac2132e25a84746

SHA512
e83690919478b9d517e2fd38fd2a165c4767ba93353ec79786c53a65560f7dc650ba807e15b9d03ccceefa5fc51f16e9c7e58e83bb453436b352ee3128677f7e

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
32KB

MD5
44b77cbacbd0e19302ecce69f966dacf

SHA1
2dc6dfc035de4170e496f7f537514a40a718801a

SHA256
3ebb37288689954fbbfc52d05ab7768a89ecff96f3152e800bded487ce820a29

SHA512
1da2a01d9eb559dca1ed5f92d66e0d4ef8375e1a40411db00c30a783ab62a0a59e2a2db86910e52bf9bf5ee75a6810dc263950c5aae2134d029f384d34b0e213

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
375KB

MD5
f6e04c06d8f537e0be149f06e3935755

SHA1
775fef7f7cb5b6971079afa4cf74a395e859e71b

SHA256
20d9ce8adfcd806810eacb6ce2255d609a4613fba582f0fcdb5e05b637e4f0a2

SHA512
e001e3db78701c24b0a7a03c03aab2681c01098ac86b1db03d361358dbbe0ec91ecc4600a239be0b76ca43cfe03e13567a4e063f2235b0040f3f27124478fed9

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
201KB

MD5
263092bc736bfac31dc1e9eefa8c20d1

SHA1
a8ba312a099ddea2f1804866e030c225b4ecd6bb

SHA256
94a657ecbc0262ebe0b8f4cee637c6feca29ffa24728b7a5f2fcee0e8190bd91

SHA512
d38137df7d19e2273f8c7f2cc945712d3339822e1cd3073ef41b82bc64b96420424944e3397fb037f5757bf478c86e08ecffa980e43ff62d555ea177575fd13f

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
333KB

MD5
fcd7d1d5318a3d42f554b3ea60507f74

SHA1
a4820d5d35b83ec2f72cd143119acc0f3c5ffbaa

SHA256
daba1a8f4847647c3827bdd93a7cac6d85028d4e8dfa941f01ca3c8d4c13bc34

SHA512
4872489ec274e172c1592bcd7023c07c0f48c0684754167068cdbc95ab514f2c5c2b5339e6bae930b14621e6d7c5b7011c2896f36fc4f8c9ecb69b9ebd2a1538

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
140KB

MD5
7d537b25f86a695ed50e84e5441d662a

SHA1
71d669c9f6d5370d30a0558b738c0c81f355f88f

SHA256
753efd758fd62976330caa0b95b01dff8c4f1ff12df5a4f4ab4f2d78435abe92

SHA512
17a7858e66c6cb9d9f3113b772660f9c9d4b6beefcbe285026438888774ebafc21902029911963778edabf400b31db0a146208cda5a8b51cb65a86e6a2391780

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
326KB

MD5
6b411bd882b7aa0d92a5bdfc18f466d5

SHA1
7b09b03167f8f966c9844838d92dc6c0973058d5

SHA256
4b787c47258a68f170e4aa7b9a147fd92b4414d0ba617b63323911192dc127da

SHA512
10ae02d9e71a297e17c71fc62072bbd2a6562f9041ad130ea9c3b23b0a89ef8b54ec124a69e45b6ceb37ee20303c19849548700566faf50c9a2acfe2cb367a66

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
551KB

MD5
07b85079ce3fe1d04b4bb1800d3adeb5

SHA1
84121df4d94066fdec8c93d3507a5b4fdd03726a

SHA256
97a21b26ce733ae912ed7d596e6fe59058b56d0b9a24ee14e4cc762d3a77f9cb

SHA512
edc507c366f07980607127b316b6e43ca60aff9d3a74d4cbd4d394e2d1c38dee9971e2ee04c7e9f1b651fca70240679f553863297db25625bdd837f003a6bba3

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
143KB

MD5
cf1cbb72866b1e19f9ac9ac13f5d5472

SHA1
8795002b45863dc82050ae4393d82d8f8cb6b9c2

SHA256
7046c4c84d0c0c0ae55f05270d16a4afcb5aba50c9aee4a59dced407382cfcec

SHA512
5900ab8ff995eefd8c41e25e12e1b370d8dbddb0831f3172874d4506ec954486720c04e6c293e0b3c4aa32c29e9e91b2206250ede5cdc97c7ab94d14b0c4087a

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
170KB

MD5
f7ba16b2e18469a9086dec1c6764105d

SHA1
9ec0c7f1e420ebb29568fa6034b1ceea3c5caaba

SHA256
96eff1b241359428154780d04d613a4745c93f97e1a92cff7d23d2462e2dd924

SHA512
6701500859b7e906912334edf71b0826629627048db99adec4ec58876c20179f899888eda678cb36a8a78ac793d139281f0d494037aa9c039c26a27309fa60d1

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
237KB

MD5
ab2f39a1888cbfdbe5a7915d5ec20884

SHA1
f3859c881eb7171aa229e7978f430e2a07c481c5

SHA256
dd768758dac2e8aac980f87407950e8491678434e9b316444c499d4484c8f7e4

SHA512
6a3d39494e56ed52e16258fb7f82ffc0d695a828d9615cbfd266bb4814bdb2400b658d549855a24fe4ee3823da5dd0a62de2c4ea7e032a2b4faeae98614f9d5d

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
99KB

MD5
02ac88082f767badae89c11843721675

SHA1
8976cc55e16fd8545aeb1b324399e0894cdeffa4

SHA256
61a8f22e7fe2334db7bc75b742b00940b7ea4c0ff1393dffa5584358c1384311

SHA512
d9936b8dc68209d3b8608312085ddde0e0bc6473c0cdead1cb471f9a8db2d1b6658245938e9fa31c6eb916afe935d03d121da4e2d1b0f2252da28a38dd2abdfc

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
176KB

MD5
ee56abc9817397af6f189d6102c59dfd

SHA1
f28caf0c7ec2128609e326241ae1b5b3e88d75a5

SHA256
2f36947b34fac8d04b1c5407f82b89d89eb698e27740b7d77eeac9184e24f714

SHA512
4b0f126639fd5d797ac17f948f2ae43058c97039581def1b7b67c375172ac856a3963d5c4027258df4e9e9fddfd4f10a767138dacba6ae9ab41e7feaf5f21a74

Download Submit
\Windows\SysWOW64\test\svchost.exe

Filesize
279KB

MD5
29f532e923c535d9460b7a3e92f22cc6

SHA1
2fd06b513320f2e37f1734756c57b70803064b03

SHA256
5b7a9ffa84dab8394ad2061f1cc8aafa6826beeed284274d6dfbaf94c2b2aff3

SHA512
9dee33afbf1883d43efe704084725407142cd728ba2620c43339aa51bed32cc9d51db1379f5973efe6817eb74c90f847397074a7c1a18e1a17f994106cba20c9

Download Submit
memory/268-115-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/268-117-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/320-152-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/320-153-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/320-151-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/328-112-0x0000000001F10000-0x0000000001F11000-memory.dmp

Filesize
4KB

Download
memory/328-71-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/328-69-0x0000000001F10000-0x0000000001F11000-memory.dmp

Filesize
4KB

Download
memory/328-66-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/588-38-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/588-42-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/588-37-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/652-191-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/852-0-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/852-235-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/852-11-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/852-1-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/1100-60-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1100-64-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1100-63-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/1116-53-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1116-49-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1148-54-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1148-58-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1148-59-0x0000000003D20000-0x0000000003D21000-memory.dmp

Filesize
4KB

Download
memory/1396-123-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1396-118-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1396-188-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1396-119-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/1540-185-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1544-100-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1544-95-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1544-96-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/1584-207-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1584-35-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1584-31-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1584-34-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/1592-76-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1592-72-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1592-73-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Filesize
4KB

Download
memory/1612-237-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1628-148-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1628-147-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1692-203-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1736-142-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1736-144-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/1736-143-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1788-183-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1800-246-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1888-48-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1888-44-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/1888-43-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1896-104-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1896-102-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1912-149-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1912-150-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2020-214-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2024-240-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2036-224-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2040-217-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2168-199-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2172-168-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2172-166-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2172-167-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2200-128-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2200-124-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2208-174-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2288-222-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2304-156-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2304-155-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/2304-154-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2356-197-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2388-218-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2456-243-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2508-180-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2584-131-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2584-129-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2584-130-0x0000000003D20000-0x0000000003D21000-memory.dmp

Filesize
4KB

Download
memory/2592-162-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2592-160-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2592-161-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/2608-232-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2628-93-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2628-92-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2644-19-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2644-23-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2644-22-0x0000000001F10000-0x0000000001F11000-memory.dmp

Filesize
4KB

Download
memory/2656-202-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2676-171-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2676-138-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/2676-137-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2676-136-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2676-169-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2756-163-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2756-165-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/2756-164-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2768-132-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2768-133-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2776-193-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2828-226-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2892-159-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/2892-158-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2892-157-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2908-78-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2908-81-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/2908-82-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2920-229-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2928-26-0x0000000000870000-0x0000000000871000-memory.dmp

Filesize
4KB

Download
memory/2928-30-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2928-25-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2960-85-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/2960-88-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2960-14-0x0000000003D60000-0x0000000003D61000-memory.dmp

Filesize
4KB

Download
memory/2960-18-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2960-84-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2960-13-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2980-111-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2980-107-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/2980-106-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/2984-177-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/3008-211-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/3032-139-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/3032-140-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/3032-141-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/3048-135-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/3048-134-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/3064-146-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/3064-145-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads