pid	Process
4344	netsh.exe
2440	netsh.exe
4736	netsh.exe
4204	netsh.exe
3656	netsh.exe
1644	netsh.exe
540	netsh.exe
5112	netsh.exe
4352	netsh.exe
2500	netsh.exe
1412	netsh.exe
4824	netsh.exe
1528	netsh.exe
4880	netsh.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	~tlEE22.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	~tlC8F1.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	svchost_dump_SCY - Copy.exe

pid	Process
4244	svchost.exe
1992	svchost.exe
876	~tlEE22.tmp
1500	svchost.exe
976	~tlC8F1.tmp
3660	svchost.exe
2012	~tl2962.tmp

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62	~tl2962.tmp
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894	~tl2962.tmp
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894	~tl2962.tmp
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D03E46CD585BBE111C712E6577BC5F07_28C82A231548529DB24817D9458A0019	~tl2962.tmp
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	~tl2962.tmp
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8	~tl2962.tmp
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8	~tl2962.tmp
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D03E46CD585BBE111C712E6577BC5F07_28C82A231548529DB24817D9458A0019	~tl2962.tmp
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62	~tl2962.tmp
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output1[1].jpg	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\Q63M5J4H.htm	~tl2962.tmp

description	ioc	Process
File created	C:\Windows\System\svchost.exe	svchost_dump_SCY - Copy.exe
File opened for modification	C:\Windows\System\svchost.exe	svchost_dump_SCY - Copy.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	~tlEE22.tmp
File opened for modification	C:\Windows\System\svchost.exe	~tlEE22.tmp
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	svchost_dump_SCY - Copy.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	~tl2962.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	~tl2962.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	~tl2962.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe

pid	Process
4236	powershell.exe
4236	powershell.exe
3192	powershell.exe
3192	powershell.exe
4236	powershell.exe
3192	powershell.exe
1444	svchost_dump_SCY - Copy.exe
1444	svchost_dump_SCY - Copy.exe
2432	powershell.exe
2432	powershell.exe
4652	powershell.exe
4652	powershell.exe
876	~tlEE22.tmp
876	~tlEE22.tmp
836	powershell.exe
4744	powershell.exe
836	powershell.exe
4744	powershell.exe
876	~tlEE22.tmp
876	~tlEE22.tmp
1500	svchost.exe
1500	svchost.exe
4656	powershell.exe
4656	powershell.exe
2920	powershell.exe
2920	powershell.exe
976	~tlC8F1.tmp
976	~tlC8F1.tmp
1412	powershell.exe
1412	powershell.exe
1804	powershell.exe
1804	powershell.exe
3660	svchost.exe
3660	svchost.exe
2420	powershell.exe
2420	powershell.exe
3664	powershell.exe
3664	powershell.exe
2012	~tl2962.tmp
2012	~tl2962.tmp
3860	powershell.exe
3860	powershell.exe
3496	powershell.exe
3496	powershell.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	224	WMIC.exe
Token: SeSecurityPrivilege	224	WMIC.exe
Token: SeTakeOwnershipPrivilege	224	WMIC.exe
Token: SeLoadDriverPrivilege	224	WMIC.exe
Token: SeSystemProfilePrivilege	224	WMIC.exe
Token: SeSystemtimePrivilege	224	WMIC.exe
Token: SeProfSingleProcessPrivilege	224	WMIC.exe
Token: SeIncBasePriorityPrivilege	224	WMIC.exe
Token: SeCreatePagefilePrivilege	224	WMIC.exe
Token: SeBackupPrivilege	224	WMIC.exe
Token: SeRestorePrivilege	224	WMIC.exe
Token: SeShutdownPrivilege	224	WMIC.exe
Token: SeDebugPrivilege	224	WMIC.exe
Token: SeSystemEnvironmentPrivilege	224	WMIC.exe
Token: SeRemoteShutdownPrivilege	224	WMIC.exe
Token: SeUndockPrivilege	224	WMIC.exe
Token: SeManageVolumePrivilege	224	WMIC.exe
Token: 33	224	WMIC.exe
Token: 34	224	WMIC.exe
Token: 35	224	WMIC.exe
Token: 36	224	WMIC.exe
Token: SeIncreaseQuotaPrivilege	224	WMIC.exe
Token: SeSecurityPrivilege	224	WMIC.exe
Token: SeTakeOwnershipPrivilege	224	WMIC.exe
Token: SeLoadDriverPrivilege	224	WMIC.exe
Token: SeSystemProfilePrivilege	224	WMIC.exe
Token: SeSystemtimePrivilege	224	WMIC.exe
Token: SeProfSingleProcessPrivilege	224	WMIC.exe
Token: SeIncBasePriorityPrivilege	224	WMIC.exe
Token: SeCreatePagefilePrivilege	224	WMIC.exe
Token: SeBackupPrivilege	224	WMIC.exe
Token: SeRestorePrivilege	224	WMIC.exe
Token: SeShutdownPrivilege	224	WMIC.exe
Token: SeDebugPrivilege	224	WMIC.exe
Token: SeSystemEnvironmentPrivilege	224	WMIC.exe
Token: SeRemoteShutdownPrivilege	224	WMIC.exe
Token: SeUndockPrivilege	224	WMIC.exe
Token: SeManageVolumePrivilege	224	WMIC.exe
Token: 33	224	WMIC.exe
Token: 34	224	WMIC.exe
Token: 35	224	WMIC.exe
Token: 36	224	WMIC.exe
Token: SeDebugPrivilege	4236	powershell.exe
Token: SeDebugPrivilege	3192	powershell.exe
Token: SeIncreaseQuotaPrivilege	1372	WMIC.exe
Token: SeSecurityPrivilege	1372	WMIC.exe
Token: SeTakeOwnershipPrivilege	1372	WMIC.exe
Token: SeLoadDriverPrivilege	1372	WMIC.exe
Token: SeSystemProfilePrivilege	1372	WMIC.exe
Token: SeSystemtimePrivilege	1372	WMIC.exe
Token: SeProfSingleProcessPrivilege	1372	WMIC.exe
Token: SeIncBasePriorityPrivilege	1372	WMIC.exe
Token: SeCreatePagefilePrivilege	1372	WMIC.exe
Token: SeBackupPrivilege	1372	WMIC.exe
Token: SeRestorePrivilege	1372	WMIC.exe
Token: SeShutdownPrivilege	1372	WMIC.exe
Token: SeDebugPrivilege	1372	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1372	WMIC.exe
Token: SeRemoteShutdownPrivilege	1372	WMIC.exe
Token: SeUndockPrivilege	1372	WMIC.exe
Token: SeManageVolumePrivilege	1372	WMIC.exe
Token: 33	1372	WMIC.exe
Token: 34	1372	WMIC.exe
Token: 35	1372	WMIC.exe

description	pid	Process	procid_target
PID 1444 wrote to memory of 224	1444	svchost_dump_SCY - Copy.exe	91
PID 1444 wrote to memory of 224	1444	svchost_dump_SCY - Copy.exe	91
PID 1444 wrote to memory of 1412	1444	svchost_dump_SCY - Copy.exe	98
PID 1444 wrote to memory of 1412	1444	svchost_dump_SCY - Copy.exe	98
PID 1444 wrote to memory of 4824	1444	svchost_dump_SCY - Copy.exe	100
PID 1444 wrote to memory of 4824	1444	svchost_dump_SCY - Copy.exe	100
PID 1444 wrote to memory of 4236	1444	svchost_dump_SCY - Copy.exe	102
PID 1444 wrote to memory of 4236	1444	svchost_dump_SCY - Copy.exe	102
PID 1444 wrote to memory of 3192	1444	svchost_dump_SCY - Copy.exe	104
PID 1444 wrote to memory of 3192	1444	svchost_dump_SCY - Copy.exe	104
PID 1444 wrote to memory of 1068	1444	svchost_dump_SCY - Copy.exe	106
PID 1444 wrote to memory of 1068	1444	svchost_dump_SCY - Copy.exe	106
PID 1444 wrote to memory of 2068	1444	svchost_dump_SCY - Copy.exe	108
PID 1444 wrote to memory of 2068	1444	svchost_dump_SCY - Copy.exe	108
PID 1444 wrote to memory of 4244	1444	svchost_dump_SCY - Copy.exe	110
PID 1444 wrote to memory of 4244	1444	svchost_dump_SCY - Copy.exe	110
PID 4244 wrote to memory of 1372	4244	svchost.exe	113
PID 4244 wrote to memory of 1372	4244	svchost.exe	113
PID 4244 wrote to memory of 4344	4244	svchost.exe	115
PID 4244 wrote to memory of 4344	4244	svchost.exe	115
PID 4244 wrote to memory of 5112	4244	svchost.exe	117
PID 4244 wrote to memory of 5112	4244	svchost.exe	117
PID 4244 wrote to memory of 2432	4244	svchost.exe	119
PID 4244 wrote to memory of 2432	4244	svchost.exe	119
PID 4244 wrote to memory of 4652	4244	svchost.exe	121
PID 4244 wrote to memory of 4652	4244	svchost.exe	121
PID 1992 wrote to memory of 4496	1992	svchost.exe	124
PID 1992 wrote to memory of 4496	1992	svchost.exe	124
PID 4244 wrote to memory of 876	4244	svchost.exe	126
PID 4244 wrote to memory of 876	4244	svchost.exe	126
PID 876 wrote to memory of 3672	876	~tlEE22.tmp	127
PID 876 wrote to memory of 3672	876	~tlEE22.tmp	127
PID 876 wrote to memory of 3656	876	~tlEE22.tmp	129
PID 876 wrote to memory of 3656	876	~tlEE22.tmp	129
PID 876 wrote to memory of 1528	876	~tlEE22.tmp	131
PID 876 wrote to memory of 1528	876	~tlEE22.tmp	131
PID 876 wrote to memory of 836	876	~tlEE22.tmp	133
PID 876 wrote to memory of 836	876	~tlEE22.tmp	133
PID 876 wrote to memory of 4744	876	~tlEE22.tmp	135
PID 876 wrote to memory of 4744	876	~tlEE22.tmp	135
PID 876 wrote to memory of 752	876	~tlEE22.tmp	137
PID 876 wrote to memory of 752	876	~tlEE22.tmp	137
PID 876 wrote to memory of 5032	876	~tlEE22.tmp	139
PID 876 wrote to memory of 5032	876	~tlEE22.tmp	139
PID 876 wrote to memory of 1500	876	~tlEE22.tmp	141
PID 876 wrote to memory of 1500	876	~tlEE22.tmp	141
PID 1500 wrote to memory of 4884	1500	svchost.exe	142
PID 1500 wrote to memory of 4884	1500	svchost.exe	142
PID 1500 wrote to memory of 4352	1500	svchost.exe	144
PID 1500 wrote to memory of 4352	1500	svchost.exe	144
PID 1500 wrote to memory of 1644	1500	svchost.exe	146
PID 1500 wrote to memory of 1644	1500	svchost.exe	146
PID 1500 wrote to memory of 4656	1500	svchost.exe	148
PID 1500 wrote to memory of 4656	1500	svchost.exe	148
PID 1500 wrote to memory of 2920	1500	svchost.exe	150
PID 1500 wrote to memory of 2920	1500	svchost.exe	150
PID 1500 wrote to memory of 976	1500	svchost.exe	152
PID 1500 wrote to memory of 976	1500	svchost.exe	152
PID 976 wrote to memory of 2700	976	~tlC8F1.tmp	153
PID 976 wrote to memory of 2700	976	~tlC8F1.tmp	153
PID 976 wrote to memory of 2440	976	~tlC8F1.tmp	155
PID 976 wrote to memory of 2440	976	~tlC8F1.tmp	155
PID 976 wrote to memory of 2500	976	~tlC8F1.tmp	157
PID 976 wrote to memory of 2500	976	~tlC8F1.tmp	157

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads