pid	Process
1912	netsh.exe
836	netsh.exe
1804	netsh.exe
320	netsh.exe
2484	netsh.exe
2432	netsh.exe
1572	netsh.exe
2644	netsh.exe
2496	netsh.exe
2580	netsh.exe
2464	netsh.exe
1852	netsh.exe
2960	netsh.exe
2660	netsh.exe

pid	Process
1688	svchost.exe
1744	~tl95F9.tmp
1888	svchost.exe
1072	~tlBBD0.tmp
2988	svchost.exe
2300	~tl7149.tmp

pid	Process
2200	svchost_dump_SCY - Copy.exe
2200	svchost_dump_SCY - Copy.exe
1688	svchost.exe
1688	svchost.exe
1744	~tl95F9.tmp
1744	~tl95F9.tmp
1888	svchost.exe
1888	svchost.exe
1084	taskeng.exe
2988	svchost.exe
2988	svchost.exe

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	~tl7149.tmp
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svchost.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\output1[1].jpg	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\getlog[1].htm	~tl7149.tmp
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\getlog[1].htm	svchost.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

description	ioc	Process
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	~tl95F9.tmp
File opened for modification	C:\Windows\System\svchost.exe	~tl95F9.tmp
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	svchost_dump_SCY - Copy.exe
File created	C:\Windows\System\svchost.exe	svchost_dump_SCY - Copy.exe
File opened for modification	C:\Windows\System\svchost.exe	svchost_dump_SCY - Copy.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	~tl7149.tmp
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D692452E-6920-4C45-9F4B-CE5205204966}\ee-50-19-7b-f1-8d	~tl7149.tmp
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-50-19-7b-f1-8d\WpadDecisionTime = b0989a24df8cda01	~tl7149.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D692452E-6920-4C45-9F4B-CE5205204966}\WpadDecision = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-50-19-7b-f1-8d\WpadDecision = "0"	~tl7149.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0"	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D692452E-6920-4C45-9F4B-CE5205204966}\WpadDecisionReason = "1"	~tl7149.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D692452E-6920-4C45-9F4B-CE5205204966}\WpadDecision = "0"	~tl7149.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	~tl7149.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D692452E-6920-4C45-9F4B-CE5205204966}\WpadNetworkName = "Network 3"	~tl7149.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-50-19-7b-f1-8d\WpadDecision = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	~tl7149.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D692452E-6920-4C45-9F4B-CE5205204966}\WpadDecisionReason = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	~tl7149.tmp
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D692452E-6920-4C45-9F4B-CE5205204966}\WpadNetworkName = "Network 3"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-50-19-7b-f1-8d\WpadDecisionReason = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	~tl7149.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	~tl7149.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	~tl7149.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	~tl7149.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	~tl7149.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	~tl7149.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D692452E-6920-4C45-9F4B-CE5205204966}\WpadDecisionTime = b0989a24df8cda01	~tl7149.tmp
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-50-19-7b-f1-8d	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D692452E-6920-4C45-9F4B-CE5205204966}	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D692452E-6920-4C45-9F4B-CE5205204966}\WpadDecisionTime = 10f2c80fdf8cda01	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{6C467336-8281-4E60-8204-430CED96822D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 010000000000000090b29b1adf8cda01	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	~tl7149.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-50-19-7b-f1-8d\WpadDetectedUrl	~tl7149.tmp
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D692452E-6920-4C45-9F4B-CE5205204966}	~tl7149.tmp
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-50-19-7b-f1-8d\WpadDecisionTime = 10f2c80fdf8cda01	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0"	netsh.exe

pid	Process
2552	powershell.exe
2880	powershell.exe
2200	svchost_dump_SCY - Copy.exe
3020	powershell.exe
1556	powershell.exe
1744	~tl95F9.tmp
3064	powershell.exe
1816	powershell.exe
1744	~tl95F9.tmp
1888	svchost.exe
1880	powershell.exe
2760	powershell.exe
1072	~tlBBD0.tmp
2848	powershell.exe
2972	powershell.exe
2988	svchost.exe
2460	powershell.exe
1880	powershell.exe
2300	~tl7149.tmp
1624	powershell.exe
2960	powershell.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2056	WMIC.exe
Token: SeSecurityPrivilege	2056	WMIC.exe
Token: SeTakeOwnershipPrivilege	2056	WMIC.exe
Token: SeLoadDriverPrivilege	2056	WMIC.exe
Token: SeSystemProfilePrivilege	2056	WMIC.exe
Token: SeSystemtimePrivilege	2056	WMIC.exe
Token: SeProfSingleProcessPrivilege	2056	WMIC.exe
Token: SeIncBasePriorityPrivilege	2056	WMIC.exe
Token: SeCreatePagefilePrivilege	2056	WMIC.exe
Token: SeBackupPrivilege	2056	WMIC.exe
Token: SeRestorePrivilege	2056	WMIC.exe
Token: SeShutdownPrivilege	2056	WMIC.exe
Token: SeDebugPrivilege	2056	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2056	WMIC.exe
Token: SeRemoteShutdownPrivilege	2056	WMIC.exe
Token: SeUndockPrivilege	2056	WMIC.exe
Token: SeManageVolumePrivilege	2056	WMIC.exe
Token: 33	2056	WMIC.exe
Token: 34	2056	WMIC.exe
Token: 35	2056	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2056	WMIC.exe
Token: SeSecurityPrivilege	2056	WMIC.exe
Token: SeTakeOwnershipPrivilege	2056	WMIC.exe
Token: SeLoadDriverPrivilege	2056	WMIC.exe
Token: SeSystemProfilePrivilege	2056	WMIC.exe
Token: SeSystemtimePrivilege	2056	WMIC.exe
Token: SeProfSingleProcessPrivilege	2056	WMIC.exe
Token: SeIncBasePriorityPrivilege	2056	WMIC.exe
Token: SeCreatePagefilePrivilege	2056	WMIC.exe
Token: SeBackupPrivilege	2056	WMIC.exe
Token: SeRestorePrivilege	2056	WMIC.exe
Token: SeShutdownPrivilege	2056	WMIC.exe
Token: SeDebugPrivilege	2056	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2056	WMIC.exe
Token: SeRemoteShutdownPrivilege	2056	WMIC.exe
Token: SeUndockPrivilege	2056	WMIC.exe
Token: SeManageVolumePrivilege	2056	WMIC.exe
Token: 33	2056	WMIC.exe
Token: 34	2056	WMIC.exe
Token: 35	2056	WMIC.exe
Token: SeDebugPrivilege	2552	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeIncreaseQuotaPrivilege	2224	WMIC.exe
Token: SeSecurityPrivilege	2224	WMIC.exe
Token: SeTakeOwnershipPrivilege	2224	WMIC.exe
Token: SeLoadDriverPrivilege	2224	WMIC.exe
Token: SeSystemProfilePrivilege	2224	WMIC.exe
Token: SeSystemtimePrivilege	2224	WMIC.exe
Token: SeProfSingleProcessPrivilege	2224	WMIC.exe
Token: SeIncBasePriorityPrivilege	2224	WMIC.exe
Token: SeCreatePagefilePrivilege	2224	WMIC.exe
Token: SeBackupPrivilege	2224	WMIC.exe
Token: SeRestorePrivilege	2224	WMIC.exe
Token: SeShutdownPrivilege	2224	WMIC.exe
Token: SeDebugPrivilege	2224	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2224	WMIC.exe
Token: SeRemoteShutdownPrivilege	2224	WMIC.exe
Token: SeUndockPrivilege	2224	WMIC.exe
Token: SeManageVolumePrivilege	2224	WMIC.exe
Token: 33	2224	WMIC.exe
Token: 34	2224	WMIC.exe
Token: 35	2224	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2224	WMIC.exe
Token: SeSecurityPrivilege	2224	WMIC.exe

description	pid	Process	procid_target
PID 2200 wrote to memory of 2056	2200	svchost_dump_SCY - Copy.exe	29
PID 2200 wrote to memory of 2056	2200	svchost_dump_SCY - Copy.exe	29
PID 2200 wrote to memory of 2056	2200	svchost_dump_SCY - Copy.exe	29
PID 2200 wrote to memory of 2580	2200	svchost_dump_SCY - Copy.exe	31
PID 2200 wrote to memory of 2580	2200	svchost_dump_SCY - Copy.exe	31
PID 2200 wrote to memory of 2580	2200	svchost_dump_SCY - Copy.exe	31
PID 2200 wrote to memory of 2644	2200	svchost_dump_SCY - Copy.exe	33
PID 2200 wrote to memory of 2644	2200	svchost_dump_SCY - Copy.exe	33
PID 2200 wrote to memory of 2644	2200	svchost_dump_SCY - Copy.exe	33
PID 2200 wrote to memory of 2552	2200	svchost_dump_SCY - Copy.exe	35
PID 2200 wrote to memory of 2552	2200	svchost_dump_SCY - Copy.exe	35
PID 2200 wrote to memory of 2552	2200	svchost_dump_SCY - Copy.exe	35
PID 2200 wrote to memory of 2880	2200	svchost_dump_SCY - Copy.exe	37
PID 2200 wrote to memory of 2880	2200	svchost_dump_SCY - Copy.exe	37
PID 2200 wrote to memory of 2880	2200	svchost_dump_SCY - Copy.exe	37
PID 2200 wrote to memory of 1892	2200	svchost_dump_SCY - Copy.exe	39
PID 2200 wrote to memory of 1892	2200	svchost_dump_SCY - Copy.exe	39
PID 2200 wrote to memory of 1892	2200	svchost_dump_SCY - Copy.exe	39
PID 2200 wrote to memory of 1748	2200	svchost_dump_SCY - Copy.exe	43
PID 2200 wrote to memory of 1748	2200	svchost_dump_SCY - Copy.exe	43
PID 2200 wrote to memory of 1748	2200	svchost_dump_SCY - Copy.exe	43
PID 2200 wrote to memory of 1688	2200	svchost_dump_SCY - Copy.exe	45
PID 2200 wrote to memory of 1688	2200	svchost_dump_SCY - Copy.exe	45
PID 2200 wrote to memory of 1688	2200	svchost_dump_SCY - Copy.exe	45
PID 1688 wrote to memory of 2224	1688	svchost.exe	47
PID 1688 wrote to memory of 2224	1688	svchost.exe	47
PID 1688 wrote to memory of 2224	1688	svchost.exe	47
PID 1688 wrote to memory of 2464	1688	svchost.exe	49
PID 1688 wrote to memory of 2464	1688	svchost.exe	49
PID 1688 wrote to memory of 2464	1688	svchost.exe	49
PID 1688 wrote to memory of 1912	1688	svchost.exe	50
PID 1688 wrote to memory of 1912	1688	svchost.exe	50
PID 1688 wrote to memory of 1912	1688	svchost.exe	50
PID 1688 wrote to memory of 3020	1688	svchost.exe	53
PID 1688 wrote to memory of 3020	1688	svchost.exe	53
PID 1688 wrote to memory of 3020	1688	svchost.exe	53
PID 1688 wrote to memory of 1556	1688	svchost.exe	55
PID 1688 wrote to memory of 1556	1688	svchost.exe	55
PID 1688 wrote to memory of 1556	1688	svchost.exe	55
PID 1688 wrote to memory of 1744	1688	svchost.exe	57
PID 1688 wrote to memory of 1744	1688	svchost.exe	57
PID 1688 wrote to memory of 1744	1688	svchost.exe	57
PID 1744 wrote to memory of 1784	1744	~tl95F9.tmp	59
PID 1744 wrote to memory of 1784	1744	~tl95F9.tmp	59
PID 1744 wrote to memory of 1784	1744	~tl95F9.tmp	59
PID 1744 wrote to memory of 1804	1744	~tl95F9.tmp	61
PID 1744 wrote to memory of 1804	1744	~tl95F9.tmp	61
PID 1744 wrote to memory of 1804	1744	~tl95F9.tmp	61
PID 1744 wrote to memory of 320	1744	~tl95F9.tmp	63
PID 1744 wrote to memory of 320	1744	~tl95F9.tmp	63
PID 1744 wrote to memory of 320	1744	~tl95F9.tmp	63
PID 1744 wrote to memory of 3064	1744	~tl95F9.tmp	65
PID 1744 wrote to memory of 3064	1744	~tl95F9.tmp	65
PID 1744 wrote to memory of 3064	1744	~tl95F9.tmp	65
PID 1744 wrote to memory of 1816	1744	~tl95F9.tmp	67
PID 1744 wrote to memory of 1816	1744	~tl95F9.tmp	67
PID 1744 wrote to memory of 1816	1744	~tl95F9.tmp	67
PID 1744 wrote to memory of 1608	1744	~tl95F9.tmp	69
PID 1744 wrote to memory of 1608	1744	~tl95F9.tmp	69
PID 1744 wrote to memory of 1608	1744	~tl95F9.tmp	69
PID 1744 wrote to memory of 1604	1744	~tl95F9.tmp	71
PID 1744 wrote to memory of 1604	1744	~tl95F9.tmp	71
PID 1744 wrote to memory of 1604	1744	~tl95F9.tmp	71
PID 1744 wrote to memory of 1888	1744	~tl95F9.tmp	73

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads