cab61ef5a0eab517b148b76d18ca22da59de49b7e48e85d4f4022f2645457fc6

Analysis

max time kernel
153s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 04:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e126fe12f819972684ab3486bcd1018.exe
Size

24KB
MD5

0e126fe12f819972684ab3486bcd1018
SHA1

9fc90e757b3d811be4e47e7e24db9396ced2a72e
SHA256

cab61ef5a0eab517b148b76d18ca22da59de49b7e48e85d4f4022f2645457fc6
SHA512

56b27091e0495644c8facd5001b90cf262f47b431cbd6a05adcdc1dfa3294904cdfe8b336a7655ae53eeda3d832be423c6a0a7cb524141595af22fc331bf9116
SSDEEP

384:ebhOmmnnw7/ru/rUQZebPufrWfyy1q9HuJ9TG5n3bIxgq/NWkiNIre2G:mOmmwyxyP4ygdQ45nBq/NWkUIrg

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1516	svshost.exe
384	svshost.exe
4608	svshost.exe
3956	svshost.exe
4620	svshost.exe
900	svshost.exe
1780	svshost.exe
3144	svshost.exe
452	svshost.exe
4908	svshost.exe
2240	svshost.exe
2152	svshost.exe
1620	svshost.exe
4092	svshost.exe
1676	svshost.exe
3204	svshost.exe
812	svshost.exe
2156	svshost.exe
4536	svshost.exe
4132	svshost.exe
2940	svshost.exe
1188	svshost.exe
2016	svshost.exe
3804	svshost.exe
1732	svshost.exe
1516	svshost.exe
1992	svshost.exe
3108	svshost.exe
2144	svshost.exe
3956	svshost.exe
368	svshost.exe
484	svshost.exe
868	svshost.exe
4632	svshost.exe
4544	svshost.exe
4252	svshost.exe
1184	svshost.exe
1156	svshost.exe
452	svshost.exe
4576	svshost.exe
3216	svshost.exe
4092	svshost.exe
212	svshost.exe
2096	svshost.exe
4020	svshost.exe
2848	svshost.exe
5044	svshost.exe
5056	svshost.exe
900	svshost.exe
2748	svshost.exe
2132	svshost.exe
3028	svshost.exe
3816	svshost.exe
4252	svshost.exe
4680	svshost.exe
1156	svshost.exe
1784	svshost.exe
1772	svshost.exe
3856	svshost.exe
3768	svshost.exe
2584	svshost.exe
2412	svshost.exe
1844	svshost.exe
4700	svshost.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	0e126fe12f819972684ab3486bcd1018.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "svshost.exe"	svshost.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	0e126fe12f819972684ab3486bcd1018.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe
File created	C:\Windows\SysWOW64\svshost.exe	svshost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 1516	4828	0e126fe12f819972684ab3486bcd1018.exe	91
PID 4828 wrote to memory of 1516	4828	0e126fe12f819972684ab3486bcd1018.exe	91
PID 4828 wrote to memory of 1516	4828	0e126fe12f819972684ab3486bcd1018.exe	91
PID 1516 wrote to memory of 384	1516	svshost.exe	92
PID 1516 wrote to memory of 384	1516	svshost.exe	92
PID 1516 wrote to memory of 384	1516	svshost.exe	92
PID 384 wrote to memory of 4608	384	svshost.exe	94
PID 384 wrote to memory of 4608	384	svshost.exe	94
PID 384 wrote to memory of 4608	384	svshost.exe	94
PID 4608 wrote to memory of 3956	4608	svshost.exe	95
PID 4608 wrote to memory of 3956	4608	svshost.exe	95
PID 4608 wrote to memory of 3956	4608	svshost.exe	95
PID 3956 wrote to memory of 4620	3956	svshost.exe	96
PID 3956 wrote to memory of 4620	3956	svshost.exe	96
PID 3956 wrote to memory of 4620	3956	svshost.exe	96
PID 4620 wrote to memory of 900	4620	svshost.exe	97
PID 4620 wrote to memory of 900	4620	svshost.exe	97
PID 4620 wrote to memory of 900	4620	svshost.exe	97
PID 900 wrote to memory of 1780	900	svshost.exe	98
PID 900 wrote to memory of 1780	900	svshost.exe	98
PID 900 wrote to memory of 1780	900	svshost.exe	98
PID 1780 wrote to memory of 3144	1780	svshost.exe	101
PID 1780 wrote to memory of 3144	1780	svshost.exe	101
PID 1780 wrote to memory of 3144	1780	svshost.exe	101
PID 3144 wrote to memory of 452	3144	svshost.exe	104
PID 3144 wrote to memory of 452	3144	svshost.exe	104
PID 3144 wrote to memory of 452	3144	svshost.exe	104
PID 452 wrote to memory of 4908	452	svshost.exe	105
PID 452 wrote to memory of 4908	452	svshost.exe	105
PID 452 wrote to memory of 4908	452	svshost.exe	105
PID 4908 wrote to memory of 2240	4908	svshost.exe	106
PID 4908 wrote to memory of 2240	4908	svshost.exe	106
PID 4908 wrote to memory of 2240	4908	svshost.exe	106
PID 2240 wrote to memory of 2152	2240	svshost.exe	108
PID 2240 wrote to memory of 2152	2240	svshost.exe	108
PID 2240 wrote to memory of 2152	2240	svshost.exe	108
PID 2152 wrote to memory of 1620	2152	svshost.exe	109
PID 2152 wrote to memory of 1620	2152	svshost.exe	109
PID 2152 wrote to memory of 1620	2152	svshost.exe	109
PID 1620 wrote to memory of 4092	1620	svshost.exe	110
PID 1620 wrote to memory of 4092	1620	svshost.exe	110
PID 1620 wrote to memory of 4092	1620	svshost.exe	110
PID 4092 wrote to memory of 1676	4092	svshost.exe	113
PID 4092 wrote to memory of 1676	4092	svshost.exe	113
PID 4092 wrote to memory of 1676	4092	svshost.exe	113
PID 1676 wrote to memory of 3204	1676	svshost.exe	114
PID 1676 wrote to memory of 3204	1676	svshost.exe	114
PID 1676 wrote to memory of 3204	1676	svshost.exe	114
PID 3204 wrote to memory of 812	3204	svshost.exe	115
PID 3204 wrote to memory of 812	3204	svshost.exe	115
PID 3204 wrote to memory of 812	3204	svshost.exe	115
PID 812 wrote to memory of 2156	812	svshost.exe	116
PID 812 wrote to memory of 2156	812	svshost.exe	116
PID 812 wrote to memory of 2156	812	svshost.exe	116
PID 2156 wrote to memory of 4536	2156	svshost.exe	117
PID 2156 wrote to memory of 4536	2156	svshost.exe	117
PID 2156 wrote to memory of 4536	2156	svshost.exe	117
PID 4536 wrote to memory of 4132	4536	svshost.exe	118
PID 4536 wrote to memory of 4132	4536	svshost.exe	118
PID 4536 wrote to memory of 4132	4536	svshost.exe	118
PID 4132 wrote to memory of 2940	4132	svshost.exe	119
PID 4132 wrote to memory of 2940	4132	svshost.exe	119
PID 4132 wrote to memory of 2940	4132	svshost.exe	119
PID 2940 wrote to memory of 1188	2940	svshost.exe	120

C:\Users\Admin\AppData\Local\Temp\0e126fe12f819972684ab3486bcd1018.exe
"C:\Users\Admin\AppData\Local\Temp\0e126fe12f819972684ab3486bcd1018.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\svshost.exe
  C:\Windows\system32\svshost.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\SysWOW64\svshost.exe
    C:\Windows\system32\svshost.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:384
  - - C:\Windows\SysWOW64\svshost.exe
      C:\Windows\system32\svshost.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4608
    - - C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3956
      - C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4620
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:900
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1780
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3144
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:452
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        14⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1620
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4092
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        16⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3204
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:812
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        19⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        20⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4536
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4132
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2940
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1188
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        24⤵
        Executes dropped EXE
        
        PID:2016
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3804
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        26⤵
        Executes dropped EXE
        
        PID:1732
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        27⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1516
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1992
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3108
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2144
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        31⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:3956
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        32⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:368
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        33⤵
        Executes dropped EXE
        
        PID:484
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:868
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4632
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        36⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4544
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        37⤵
        Executes dropped EXE
        
        PID:4252
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        38⤵
        Executes dropped EXE
        
        PID:1184
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        39⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1156
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        40⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:452
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        41⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4576
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3216
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4092
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        44⤵
        Executes dropped EXE
        
        PID:212
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        45⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2096
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        46⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4020
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2848
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5044
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5056
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:900
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        51⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2748
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        52⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2132
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        53⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:3028
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        54⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:3816
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        55⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4252
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        56⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:4680
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        57⤵
        Executes dropped EXE
        
        PID:1156
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        58⤵
        Executes dropped EXE
        
        PID:1784
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        59⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1772
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        60⤵
        Executes dropped EXE
        
        PID:3856
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3768
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        62⤵
        Executes dropped EXE
        
        PID:2584
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        63⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2412
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        64⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1844
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        65⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:4700
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        66⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        67⤵
        Drops file in System32 directory
        
        PID:2956
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        68⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:536
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        69⤵
        Drops file in System32 directory
        
        PID:4840
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        70⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        71⤵
        Adds Run key to start application
        
        PID:4712
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        72⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        73⤵
        Drops file in System32 directory
        
        PID:3532
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        74⤵
        Adds Run key to start application
        
        PID:4180
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        75⤵
        Drops file in System32 directory
        
        PID:4612
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        76⤵
        Adds Run key to start application
        
        PID:2332
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        77⤵
        Adds Run key to start application
        
        PID:2788
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        78⤵
        Drops file in System32 directory
        
        PID:4172
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        79⤵
        Drops file in System32 directory
        
        PID:2848
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        80⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:5044
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        81⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3656
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        82⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        83⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4992
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        84⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        85⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        86⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:804
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        87⤵
        Drops file in System32 directory
        
        PID:3144
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        88⤵
        Adds Run key to start application
        
        PID:4824
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        89⤵
        Adds Run key to start application
        
        PID:1716
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        90⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        91⤵
        Drops file in System32 directory
        
        PID:4908
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        92⤵
        Adds Run key to start application
        
        PID:1528
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        93⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        94⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4708
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        95⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4484
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        96⤵
        Drops file in System32 directory
        
        PID:980
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        97⤵
        Drops file in System32 directory
        
        PID:1932
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        98⤵
        Adds Run key to start application
        
        PID:4868
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        99⤵
        Adds Run key to start application
        
        PID:2652
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        100⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2192
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        101⤵
        
        PID:848
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        102⤵
        Drops file in System32 directory
        
        PID:3872
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        103⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:368
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        104⤵
        Adds Run key to start application
        
        PID:1328
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        105⤵
        
        PID:752
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        106⤵
        Adds Run key to start application
        
        PID:1708
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        107⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:640
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        108⤵
        Drops file in System32 directory
        
        PID:3268
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        109⤵
        Adds Run key to start application
        
        PID:4712
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        110⤵
        Adds Run key to start application
        
        PID:2900
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        111⤵
        Drops file in System32 directory
        
        PID:4956
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        112⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1620
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        113⤵
        Adds Run key to start application
        
        PID:3188
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        114⤵
        Adds Run key to start application
        
        PID:4068
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        115⤵
        
        PID:220
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        116⤵
        Adds Run key to start application
        
        PID:2192
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        117⤵
        Adds Run key to start application
        
        PID:2244
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        118⤵
        Drops file in System32 directory
        
        PID:3320
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        119⤵
        
        PID:948
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        120⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        121⤵
        Adds Run key to start application
        
        PID:1328
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        122⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        123⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        124⤵
        Drops file in System32 directory
        
        PID:928
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        125⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2308
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        126⤵
        Adds Run key to start application
        
        PID:1492
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        127⤵
        Drops file in System32 directory
        
        PID:4680
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        128⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4652
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        129⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1160
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        130⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        131⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        132⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1156
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        133⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        134⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        135⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        136⤵
        Adds Run key to start application
        
        PID:2676
        
        C:\Windows\SysWOW64\svshost.exe
        
        C:\Windows\system32\svshost.exe
        137⤵
        
        PID:4708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\svshost.exe

Filesize
24KB

MD5
0e126fe12f819972684ab3486bcd1018

SHA1
9fc90e757b3d811be4e47e7e24db9396ced2a72e

SHA256
cab61ef5a0eab517b148b76d18ca22da59de49b7e48e85d4f4022f2645457fc6

SHA512
56b27091e0495644c8facd5001b90cf262f47b431cbd6a05adcdc1dfa3294904cdfe8b336a7655ae53eeda3d832be423c6a0a7cb524141595af22fc331bf9116

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads