Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2025, 05:54
Behavioral task
behavioral1
Sample
a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe
Resource
win10v2004-20241007-en
General
-
Target
a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe
-
Size
2.9MB
-
MD5
12f4f1ac7cd367aa724d78b69513185e
-
SHA1
1bf103bfda1d3fa6956e29bbe3fc551759c26199
-
SHA256
a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c
-
SHA512
2c5f77b3fb5146c7d5b7b1d259f93ef3921c9d05bf0cac865aae2a28787349ca7ca70394867f256b0d688637b65979da8cf552133bbb945fd82c49b501dbf21e
-
SSDEEP
24576:7v97AXmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHg:7v97AXmw4gxeOw46fUbNecCCFbNec1
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 3 IoCs
resource yara_rule behavioral2/files/0x000a000000023c14-32.dat warzonerat behavioral2/files/0x0009000000023c0e-58.dat warzonerat behavioral2/files/0x0003000000022701-73.dat warzonerat -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 36 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Executes dropped EXE 64 IoCs
pid Process 956 explorer.exe 1820 explorer.exe 5012 explorer.exe 2060 spoolsv.exe 4552 spoolsv.exe 3584 spoolsv.exe 4904 spoolsv.exe 4788 spoolsv.exe 1752 spoolsv.exe 1420 spoolsv.exe 4052 spoolsv.exe 4536 spoolsv.exe 1312 spoolsv.exe 4836 spoolsv.exe 3060 spoolsv.exe 5068 spoolsv.exe 2396 spoolsv.exe 4112 spoolsv.exe 1368 spoolsv.exe 1524 spoolsv.exe 1468 spoolsv.exe 3380 spoolsv.exe 3248 spoolsv.exe 704 spoolsv.exe 4588 spoolsv.exe 3220 spoolsv.exe 4728 spoolsv.exe 5032 spoolsv.exe 4900 spoolsv.exe 2480 spoolsv.exe 5060 spoolsv.exe 2288 spoolsv.exe 2104 spoolsv.exe 1840 spoolsv.exe 4992 spoolsv.exe 4808 spoolsv.exe 4336 spoolsv.exe 2300 spoolsv.exe 2108 spoolsv.exe 3980 spoolsv.exe 464 spoolsv.exe 3944 spoolsv.exe 4944 spoolsv.exe 4996 spoolsv.exe 4424 spoolsv.exe 4332 spoolsv.exe 1580 spoolsv.exe 4372 spoolsv.exe 2364 spoolsv.exe 3600 spoolsv.exe 3084 spoolsv.exe 4592 spoolsv.exe 1904 spoolsv.exe 4524 spoolsv.exe 3468 spoolsv.exe 2288 spoolsv.exe 4820 spoolsv.exe 4624 spoolsv.exe 1408 spoolsv.exe 844 spoolsv.exe 4404 spoolsv.exe 1660 spoolsv.exe 1244 spoolsv.exe 2696 spoolsv.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 40 IoCs
description pid Process procid_target PID 4676 set thread context of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 2340 set thread context of 2884 2340 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 102 PID 2340 set thread context of 1112 2340 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 103 PID 956 set thread context of 1820 956 explorer.exe 107 PID 1820 set thread context of 5012 1820 explorer.exe 109 PID 1820 set thread context of 4192 1820 explorer.exe 110 PID 2060 set thread context of 4552 2060 spoolsv.exe 114 PID 3584 set thread context of 4904 3584 spoolsv.exe 118 PID 4788 set thread context of 1752 4788 spoolsv.exe 122 PID 1420 set thread context of 4052 1420 spoolsv.exe 126 PID 4536 set thread context of 1312 4536 spoolsv.exe 130 PID 4836 set thread context of 3060 4836 spoolsv.exe 134 PID 5068 set thread context of 2396 5068 spoolsv.exe 138 PID 4112 set thread context of 1368 4112 spoolsv.exe 142 PID 1524 set thread context of 1468 1524 spoolsv.exe 146 PID 3380 set thread context of 3248 3380 spoolsv.exe 150 PID 704 set thread context of 4588 704 spoolsv.exe 154 PID 3220 set thread context of 4728 3220 spoolsv.exe 158 PID 5032 set thread context of 4900 5032 spoolsv.exe 162 PID 2480 set thread context of 5060 2480 spoolsv.exe 166 PID 2288 set thread context of 2104 2288 spoolsv.exe 170 PID 1840 set thread context of 4992 1840 spoolsv.exe 174 PID 4808 set thread context of 4336 4808 spoolsv.exe 178 PID 2300 set thread context of 2108 2300 spoolsv.exe 182 PID 3980 set thread context of 464 3980 spoolsv.exe 186 PID 3944 set thread context of 4944 3944 spoolsv.exe 190 PID 4996 set thread context of 4424 4996 spoolsv.exe 194 PID 4332 set thread context of 1580 4332 spoolsv.exe 198 PID 4372 set thread context of 2364 4372 spoolsv.exe 202 PID 3600 set thread context of 3084 3600 spoolsv.exe 206 PID 4592 set thread context of 1904 4592 spoolsv.exe 210 PID 4524 set thread context of 3468 4524 spoolsv.exe 214 PID 2288 set thread context of 4820 2288 spoolsv.exe 218 PID 4624 set thread context of 1408 4624 spoolsv.exe 222 PID 844 set thread context of 4172 844 spoolsv.exe 305 PID 1348 set thread context of 1516 1348 spoolsv.exe 388 PID 1280 set thread context of 4616 1280 spoolsv.exe 471 PID 2984 set thread context of 232 2984 spoolsv.exe 554 PID 2620 set thread context of 1424 2620 spoolsv.exe 637 PID 3280 set thread context of 4940 3280 spoolsv.exe 720 -
Drops file in Windows directory 39 IoCs
description ioc Process File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 3832 2420 WerFault.exe 812 1104 3280 WerFault.exe 816 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID dwm.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe -
Modifies data under HKEY_USERS 54 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 2884 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 2884 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 956 explorer.exe 956 explorer.exe 2060 spoolsv.exe 2060 spoolsv.exe 5012 explorer.exe 5012 explorer.exe 5012 explorer.exe 5012 explorer.exe 3584 spoolsv.exe 3584 spoolsv.exe 5012 explorer.exe 5012 explorer.exe 4788 spoolsv.exe 4788 spoolsv.exe 5012 explorer.exe 5012 explorer.exe 1420 spoolsv.exe 1420 spoolsv.exe 5012 explorer.exe 5012 explorer.exe 4536 spoolsv.exe 4536 spoolsv.exe 5012 explorer.exe 5012 explorer.exe 4836 spoolsv.exe 4836 spoolsv.exe 5012 explorer.exe 5012 explorer.exe 5068 spoolsv.exe 5068 spoolsv.exe 5012 explorer.exe 5012 explorer.exe 4112 spoolsv.exe 4112 spoolsv.exe 5012 explorer.exe 5012 explorer.exe 1524 spoolsv.exe 1524 spoolsv.exe 5012 explorer.exe 5012 explorer.exe 3380 spoolsv.exe 3380 spoolsv.exe 5012 explorer.exe 5012 explorer.exe 704 spoolsv.exe 704 spoolsv.exe 5012 explorer.exe 5012 explorer.exe 3220 spoolsv.exe 3220 spoolsv.exe 5012 explorer.exe 5012 explorer.exe 5032 spoolsv.exe 5032 spoolsv.exe 5012 explorer.exe 5012 explorer.exe 2480 spoolsv.exe 2480 spoolsv.exe 5012 explorer.exe 5012 explorer.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeCreateGlobalPrivilege 1388 dwm.exe Token: SeChangeNotifyPrivilege 1388 dwm.exe Token: 33 1388 dwm.exe Token: SeIncBasePriorityPrivilege 1388 dwm.exe Token: SeCreateGlobalPrivilege 4808 dwm.exe Token: SeChangeNotifyPrivilege 4808 dwm.exe Token: 33 4808 dwm.exe Token: SeIncBasePriorityPrivilege 4808 dwm.exe Token: SeCreateGlobalPrivilege 2236 dwm.exe Token: SeChangeNotifyPrivilege 2236 dwm.exe Token: 33 2236 dwm.exe Token: SeIncBasePriorityPrivilege 2236 dwm.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 2884 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 2884 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 956 explorer.exe 956 explorer.exe 5012 explorer.exe 5012 explorer.exe 2060 spoolsv.exe 2060 spoolsv.exe 5012 explorer.exe 5012 explorer.exe 3584 spoolsv.exe 3584 spoolsv.exe 4788 spoolsv.exe 4788 spoolsv.exe 1420 spoolsv.exe 1420 spoolsv.exe 4536 spoolsv.exe 4536 spoolsv.exe 4836 spoolsv.exe 4836 spoolsv.exe 5068 spoolsv.exe 5068 spoolsv.exe 4112 spoolsv.exe 4112 spoolsv.exe 1524 spoolsv.exe 1524 spoolsv.exe 3380 spoolsv.exe 3380 spoolsv.exe 704 spoolsv.exe 704 spoolsv.exe 3220 spoolsv.exe 3220 spoolsv.exe 5032 spoolsv.exe 5032 spoolsv.exe 2480 spoolsv.exe 2480 spoolsv.exe 2288 spoolsv.exe 2288 spoolsv.exe 1840 spoolsv.exe 1840 spoolsv.exe 4808 spoolsv.exe 4808 spoolsv.exe 2300 spoolsv.exe 2300 spoolsv.exe 3980 spoolsv.exe 3980 spoolsv.exe 3944 spoolsv.exe 3944 spoolsv.exe 4996 spoolsv.exe 4996 spoolsv.exe 4332 spoolsv.exe 4332 spoolsv.exe 4372 spoolsv.exe 4372 spoolsv.exe 3600 spoolsv.exe 3600 spoolsv.exe 4592 spoolsv.exe 4592 spoolsv.exe 4524 spoolsv.exe 4524 spoolsv.exe 2288 spoolsv.exe 2288 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4676 wrote to memory of 3560 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 83 PID 4676 wrote to memory of 3560 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 83 PID 4676 wrote to memory of 3560 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 83 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 4676 wrote to memory of 2340 4676 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 85 PID 2340 wrote to memory of 2884 2340 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 102 PID 2340 wrote to memory of 2884 2340 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 102 PID 2340 wrote to memory of 2884 2340 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 102 PID 2340 wrote to memory of 2884 2340 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 102 PID 2340 wrote to memory of 2884 2340 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 102 PID 2340 wrote to memory of 2884 2340 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 102 PID 2340 wrote to memory of 2884 2340 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 102 PID 2340 wrote to memory of 2884 2340 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 102 PID 2340 wrote to memory of 1112 2340 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 103 PID 2340 wrote to memory of 1112 2340 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 103 PID 2340 wrote to memory of 1112 2340 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 103 PID 2340 wrote to memory of 1112 2340 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 103 PID 2340 wrote to memory of 1112 2340 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 103 PID 2884 wrote to memory of 956 2884 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 104 PID 2884 wrote to memory of 956 2884 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 104 PID 2884 wrote to memory of 956 2884 a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe 104 PID 956 wrote to memory of 416 956 explorer.exe 105 PID 956 wrote to memory of 416 956 explorer.exe 105 PID 956 wrote to memory of 416 956 explorer.exe 105 PID 956 wrote to memory of 1820 956 explorer.exe 107 PID 956 wrote to memory of 1820 956 explorer.exe 107 PID 956 wrote to memory of 1820 956 explorer.exe 107 PID 956 wrote to memory of 1820 956 explorer.exe 107 PID 956 wrote to memory of 1820 956 explorer.exe 107 PID 956 wrote to memory of 1820 956 explorer.exe 107 PID 956 wrote to memory of 1820 956 explorer.exe 107 PID 956 wrote to memory of 1820 956 explorer.exe 107 PID 956 wrote to memory of 1820 956 explorer.exe 107 PID 956 wrote to memory of 1820 956 explorer.exe 107 PID 956 wrote to memory of 1820 956 explorer.exe 107 PID 956 wrote to memory of 1820 956 explorer.exe 107 PID 956 wrote to memory of 1820 956 explorer.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe"C:\Users\Admin\AppData\Local\Temp\a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3560
-
-
C:\Users\Admin\AppData\Local\Temp\a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exeC:\Users\Admin\AppData\Local\Temp\a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exeC:\Users\Admin\AppData\Local\Temp\a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c.exe3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"5⤵
- Drops startup file
PID:416
-
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1820 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5012 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3868
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4552
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4828
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4904
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4864
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1752
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:4808
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4052
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4164
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1312
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2896
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3060
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:464
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2396
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1108
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1368
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4520
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1468
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2748
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3248
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3056
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4588
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4608
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4728
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3720
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4900
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4524
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5060
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2332
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2104
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4576
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4992
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2752
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4336
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2696
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2108
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3280
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:464
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2484
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4944
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4440
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4424
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1160
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1580
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2948
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2364
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4608
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3084
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2760
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1904
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3988
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3468
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:116
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4820
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3824
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1408
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3204
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4404
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1660
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1244
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2696
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3968
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1532
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1184
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4836
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2960
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3164
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1516
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2100
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1388
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1852
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4044
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2516
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2148
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:920
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3280
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3980
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4108
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3156
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:956
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2228
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4412
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3456
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3260
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3276
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1772
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2788
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3772
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2456
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2040
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3168
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3944
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2212
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4680
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5040
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4936
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1708
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3460
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4500
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1604
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3940
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2244
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4444
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2876
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2224
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4440
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4996
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4204
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4116
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1848
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1492
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1068
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5008
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4968
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4620
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4520
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4356
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4168
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3064
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1160
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4032
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4528
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:764
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1948
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2656
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4584
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:704
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4880
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1576
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1596
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2236
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:224
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2360
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2420
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3620
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3540
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4172
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:4296
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4376
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2844
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3788
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5056
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4932
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2744
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1512
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3604
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5064
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3048
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:244
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4012
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2512
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3080
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3488
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:848
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1252
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3584
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1612
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:64
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3572
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3808
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2324
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1268
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2480
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:544
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1652
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2332
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4800
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:968
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2660
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:472
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4460
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1696
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2092
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3928
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1844
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:460
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1776
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:636
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2288
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:324
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3272
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4064
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2284
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4908
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:768
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1232
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3348
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4316
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1816
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1840
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3824
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4624
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2752
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:888
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3124
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2860
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1104
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3964
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:240
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1180
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3296
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1228
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4048
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4808
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4164
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4400
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3204
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4404
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1660
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1244
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2696
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3968
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1184
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1532
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4836
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2960
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3164
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- System Location Discovery: System Language Discovery
PID:1516
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3744
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3456
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3276
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1772
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2788
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3772
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2456
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2040
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3168
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3944
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2212
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4680
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5040
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4500
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4936
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1708
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3460
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1604
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3940
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2244
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4444
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2876
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2224
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4440
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4996
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4204
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4116
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1848
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5008
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1068
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1492
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4620
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4968
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4520
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4168
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4356
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3064
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1160
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4032
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:704
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4528
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2656
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:764
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1948
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4584
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1596
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4880
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:852
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4508
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2948
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4372
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3628
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1076
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3000
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1876
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:816
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3216
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2336
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1044
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4816
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4608
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:216
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3240
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2352
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5032
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1852
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2932
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2240
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1740
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4628
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2052
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1864
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:440
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1628
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1164
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3604
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2760
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1572
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:400
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3404
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- System Location Discovery: System Language Discovery
PID:4616
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:836
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1684
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1384
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4576
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3292
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5016
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:632
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1616
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2536
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:648
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:556
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4896
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3472
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3952
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4300
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4872
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1392
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4452
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:60
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3244
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3452
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2896
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1520
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4596
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4540
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1244
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3968
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1184
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1532
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4836
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2960
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3164
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4216
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3224
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2148
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:956
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3260
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4412
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1424
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2228
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:416
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2236
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2552
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:920
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3280
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3980
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5104
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3512
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3992
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4060
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1584
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2724
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2484
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2220
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3192
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4112
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3696
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3288
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4016
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5068
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3036
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4040
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4472
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2448
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4612
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4448
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4364
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1404
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4560
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2648
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2568
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2968
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1892
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2748
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4512
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3380
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3256
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4168
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1780
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3804
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:232
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:4840
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:940
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1876
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:816
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3216
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2336
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1044
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:216
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4816
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4608
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3240
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5032
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2352
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1504
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3220
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2932
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1740
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1164
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4628
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2052
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1864
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:440
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1628
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3604
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2760
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1572
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:400
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3404
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4568
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3080
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1280
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3584
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2324
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1652
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:544
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4180
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1268
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4436
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:872
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4500
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3460
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1016
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3572
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3348
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4316
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1816
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1840
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2752
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3824
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4624
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:888
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2860
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3124
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1104
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3964
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:240
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3296
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1180
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4048
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1228
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4808
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4164
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4400
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3204
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1520
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4596
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4540
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1244
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3968
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3264
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1184
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4836
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2960
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4216
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3164
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3224
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2148
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:956
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3260
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4412
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1424
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3980
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2220
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3696
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3192
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4112
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3288
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4016
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5068
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3036
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4040
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4472
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2448
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4612
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4448
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4440
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4364
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4560
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2648
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2568
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2968
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1892
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2748
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4512
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3380
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3256
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4168
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1780
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3804
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2984
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4528
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4332
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:704
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2656
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1596
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3628
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2948
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2420
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4372
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3716
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1884
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1076
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2236
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3832
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1948
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3000
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4584
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:236
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3728
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1508
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3600
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3228
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3208
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:420
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3636
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2240
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4296
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4376
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1504
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3788
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3720
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2844
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4932
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5056
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5064
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2744
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1512
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2716
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2760
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:244
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4012
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2944
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1252
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1428
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5004
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5088
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3808
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4524
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3988
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2480
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:180
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- System Location Discovery: System Language Discovery
PID:4940
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:4624
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4444
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2224
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4996
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1404
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4204
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5008
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1848
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4116
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1492
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1068
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4620
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4968
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3064
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4168
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3804
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2984
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4332
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4528
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1596
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:704
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2656
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2948
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3628
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2420
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4372
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3716
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1884
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3832
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1076
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2236
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1948
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3000
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4584
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:236
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3728
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1508
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3600
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3228
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3208
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:420
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3636
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2240
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4296
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4376
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4628
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2052
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1740
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1164
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1864
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3604
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:440
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1628
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2716
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4012
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2944
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5004
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1428
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2324
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1652
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:180
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4524
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3988
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3280
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2860
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3952
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:648
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3452
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1520
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3592
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4048
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4404
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:576
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3244
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4540
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1692
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1688
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:392
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1168
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1172
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1216
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1220
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:2420
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 5048⤵
- Program crash
PID:3832
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- System Location Discovery: System Language Discovery
PID:3280 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 5048⤵
- Program crash
PID:1104
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵PID:4192
-
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"3⤵PID:1112
-
-
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1388
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2420 -ip 24201⤵PID:844
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3280 -ip 32801⤵PID:3296
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4808
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2236
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:4924
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:3988
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1884
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD512f4f1ac7cd367aa724d78b69513185e
SHA11bf103bfda1d3fa6956e29bbe3fc551759c26199
SHA256a92231c04e16baea2a3f1c84cfb641972661b136a880a76ef2848f356509b81c
SHA5122c5f77b3fb5146c7d5b7b1d259f93ef3921c9d05bf0cac865aae2a28787349ca7ca70394867f256b0d688637b65979da8cf552133bbb945fd82c49b501dbf21e
-
Filesize
93B
MD58445bfa5a278e2f068300c604a78394b
SHA19fb4eef5ec2606bd151f77fdaa219853d4aa0c65
SHA2565ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c
SHA5128ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822
-
Filesize
92B
MD513222a4bb413aaa8b92aa5b4f81d2760
SHA1268a48f2fe84ed49bbdc1873a8009db8c7cba66a
SHA256d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d
SHA512eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140
-
Filesize
2.9MB
MD574c0333493c2712b0f664045e303c415
SHA1198927e0c0e98f0a4d59c71513f111116cf96056
SHA256ae9657086c0ccff046047133b3ab25b9208b8e68b28dd54d18c2e66d503b88bd
SHA512cca241c2e81d66918943e522fca2ba28e17ff23b680a1ee4dcbd572d754809c3a4d9fb35f02eed123f54da24a41fc76d020da4c005624a3d9314769689b97519
-
Filesize
2.9MB
MD5fa3b05a2b66da578e067ecee76d47689
SHA14e50cc82753decaf205cfdb1db0c79db4c8be04c
SHA25610b4a160f2fb567ce628cf9041d8e1529c112612e6fabd3c375f16c3dd7c15c5
SHA51203ee8512046a8fc0a1c2df558129e5897c9baaaa071721853f60f35ea52cb8fbee9754e14bd571592d5b6607825db0978b60eaf24aef752fe854111e62c3537d