Malware Analysis Report

2025-08-05 17:02

Sample ID 240107-yb9zascgaq
Target ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe
SHA256 e4ce52c013c005d6f21384cd6ca2f3b2ff2cfb3f327565344054928d42019729
Tags
evasion
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e4ce52c013c005d6f21384cd6ca2f3b2ff2cfb3f327565344054928d42019729

Threat Level: Known bad

The file ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe was found to be: Known bad.

Malicious Activity Summary

evasion

Modifies firewall policy service

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-07 19:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-07 19:37

Reported

2024-01-07 19:40

Platform

win7-20231215-en

Max time kernel

119s

Max time network

123s

Command Line

winlogon.exe

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2040 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\wininit.exe
PID 2040 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\wininit.exe
PID 2040 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\wininit.exe
PID 2040 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\wininit.exe
PID 2040 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\wininit.exe
PID 2040 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\wininit.exe
PID 2040 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\wininit.exe
PID 2040 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\csrss.exe
PID 2040 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\csrss.exe
PID 2040 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\csrss.exe
PID 2040 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\csrss.exe
PID 2040 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\csrss.exe
PID 2040 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\csrss.exe
PID 2040 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\csrss.exe
PID 2040 wrote to memory of 420 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\winlogon.exe
PID 2040 wrote to memory of 420 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\winlogon.exe
PID 2040 wrote to memory of 420 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\winlogon.exe
PID 2040 wrote to memory of 420 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\winlogon.exe
PID 2040 wrote to memory of 420 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\winlogon.exe
PID 2040 wrote to memory of 420 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\winlogon.exe
PID 2040 wrote to memory of 420 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\winlogon.exe
PID 2040 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\services.exe
PID 2040 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\services.exe
PID 2040 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\services.exe
PID 2040 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\services.exe
PID 2040 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\services.exe
PID 2040 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\services.exe
PID 2040 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\services.exe
PID 2040 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\lsass.exe
PID 2040 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\lsass.exe
PID 2040 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\lsass.exe
PID 2040 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\lsass.exe
PID 2040 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\lsass.exe
PID 2040 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\lsass.exe
PID 2040 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\lsass.exe
PID 2040 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\lsm.exe
PID 2040 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\lsm.exe
PID 2040 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\lsm.exe
PID 2040 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\lsm.exe
PID 2040 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\lsm.exe
PID 2040 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\lsm.exe
PID 2040 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\lsm.exe
PID 2040 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 2040 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 2040 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 2040 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 2040 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 2040 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 2040 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 2040 wrote to memory of 680 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 2040 wrote to memory of 680 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 2040 wrote to memory of 680 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 2040 wrote to memory of 680 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 2040 wrote to memory of 680 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 2040 wrote to memory of 680 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 2040 wrote to memory of 680 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 2040 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\System32\svchost.exe
PID 2040 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\System32\svchost.exe
PID 2040 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\System32\svchost.exe
PID 2040 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\System32\svchost.exe
PID 2040 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\System32\svchost.exe
PID 2040 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\System32\svchost.exe
PID 2040 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\System32\svchost.exe
PID 2040 wrote to memory of 816 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\System32\svchost.exe

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\csrss.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

C:\Windows\system32\wininit.exe

wininit.exe

C:\Windows\system32\services.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe

"C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

Network

N/A

Files

memory/2040-0-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2040-1-0x0000000077A2F000-0x0000000077A30000-memory.dmp

memory/2040-2-0x0000000077A30000-0x0000000077A31000-memory.dmp

memory/2040-3-0x0000000000400000-0x000000000041B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-07 19:37

Reported

2024-01-07 19:40

Platform

win10v2004-20231215-en

Max time kernel

143s

Max time network

164s

Command Line

winlogon.exe

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe:*:enabled:@shell32.dll,-1" C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4556 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\winlogon.exe
PID 4556 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\winlogon.exe
PID 4556 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\winlogon.exe
PID 4556 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\winlogon.exe
PID 4556 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\winlogon.exe
PID 4556 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\winlogon.exe
PID 4556 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\lsass.exe
PID 4556 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\lsass.exe
PID 4556 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\lsass.exe
PID 4556 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\lsass.exe
PID 4556 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\lsass.exe
PID 4556 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\lsass.exe
PID 4556 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\fontdrvhost.exe
PID 4556 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\fontdrvhost.exe
PID 4556 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\fontdrvhost.exe
PID 4556 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\fontdrvhost.exe
PID 4556 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\fontdrvhost.exe
PID 4556 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\fontdrvhost.exe
PID 4556 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\fontdrvhost.exe
PID 4556 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\fontdrvhost.exe
PID 4556 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\fontdrvhost.exe
PID 4556 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\fontdrvhost.exe
PID 4556 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\fontdrvhost.exe
PID 4556 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\fontdrvhost.exe
PID 4556 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\dwm.exe
PID 4556 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\dwm.exe
PID 4556 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\dwm.exe
PID 4556 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\dwm.exe
PID 4556 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\dwm.exe
PID 4556 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\dwm.exe
PID 4556 wrote to memory of 528 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 528 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 528 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 528 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 528 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 528 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\system32\svchost.exe
PID 4556 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\System32\svchost.exe
PID 4556 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\System32\svchost.exe
PID 4556 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\System32\svchost.exe
PID 4556 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe C:\Windows\System32\svchost.exe

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s nsi

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService

C:\Windows\sysmon.exe

C:\Windows\sysmon.exe

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca

C:\Windows\system32\MusNotification.exe

C:\Windows\system32\MusNotification.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager

C:\Windows\system32\SppExtComObj.exe

C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe

"C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe"

Network

Country Destination Domain Proto
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 1.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 74.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 kto.gind.at udp
US 8.8.8.8:53 tff.vilq.ru udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 114.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 226.162.46.104.in-addr.arpa udp

Files

memory/4556-0-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4556-1-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/4556-2-0x0000000077A82000-0x0000000077A83000-memory.dmp

memory/4556-3-0x0000000077A83000-0x0000000077A84000-memory.dmp

memory/4556-4-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/4556-5-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/4556-6-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/4556-9-0x0000000000400000-0x000000000041B000-memory.dmp