Analysis
- max time kernel
52s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 23:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_d7ec31427f9c7895d1cf9e856cd3780a_cobalt-strike_icedid_ryuk.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_d7ec31427f9c7895d1cf9e856cd3780a_cobalt-strike_icedid_ryuk.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
General
- Target 2026-08-19_d7ec31427f9c7895d1cf9e856cd3780a_cobalt-strike_icedid_ryuk.exe
- Size 170KB
- Sample260819-3tl3eawcnd
- SHA256 1514da33d70bec33e662b764395b3f067e24d9427440179ab5c211f845d8824a
- MD5 d7ec31427f9c7895d1cf9e856cd3780a
- SHA1 b0497903df47478df663e30ff0c6b15f4c48799f
- SHA512 4306c143c3069394ea757f2a477bdf36ecde72a36024668bbcd23042e3ff4244be6f6b40a28f61625f3ce8eda9524dce0f6541e6f8ed9a336c0b0e38bf3cb067
- SSDEEP 3072:JAOMsXUbXJjdHkd8RVfxfErKHfCU1ELdvfNOtPeJHi7RDNM+wIdMpxLVs4EPredR:J5Myg9dE0p3HgWbNM+BMprsadxd/Upw8
- TLSH T19A040844F2AE50E8E0668134A9924751BAF37C1507645FFF07A44F6AAEE36C07D3BB60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 4 IoCs
flow pid Process 3 5096 fontdrvhost.exe 11 2844 fontdrvhost.exe 12 5424 svc_cache_2844.exe 13 756 svc_cache_5424.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
pid Process 4592 fontdrvhost.exe 5096 fontdrvhost.exe 260 svc_cache_5096.exe 2844 fontdrvhost.exe 5424 svc_cache_2844.exe 756 svc_cache_5424.exe 2124 svc_cache_756.exe 2864 fontdrvhost.exe 4780 fontdrvhost.exe 2612 fontdrvhost.exe 3468 fontdrvhost.exe 2552 fontdrvhost.exe 5920 fontdrvhost.exe 4648 fontdrvhost.exe 4784 fontdrvhost.exe 468 fontdrvhost.exe 1620 fontdrvhost.exe 6136 fontdrvhost.exe 1196 fontdrvhost.exe 5756 fontdrvhost.exe 3112 fontdrvhost.exe 1948 fontdrvhost.exe 1740 fontdrvhost.exe 4252 fontdrvhost.exe 1972 fontdrvhost.exe 2064 fontdrvhost.exe 2900 fontdrvhost.exe 1472 fontdrvhost.exe 3532 fontdrvhost.exe 6000 fontdrvhost.exe 4064 fontdrvhost.exe 5896 fontdrvhost.exe 2784 fontdrvhost.exe 4348 fontdrvhost.exe 5964 fontdrvhost.exe 4244 fontdrvhost.exe 3736 fontdrvhost.exe 2104 fontdrvhost.exe 3684 fontdrvhost.exe 4120 fontdrvhost.exe 1192 fontdrvhost.exe 3388 fontdrvhost.exe 3564 fontdrvhost.exe 3628 fontdrvhost.exe 3240 fontdrvhost.exe 1164 fontdrvhost.exe 2324 fontdrvhost.exe 3076 fontdrvhost.exe 5052 fontdrvhost.exe 4892 fontdrvhost.exe 948 fontdrvhost.exe 1444 fontdrvhost.exe 2496 fontdrvhost.exe 2896 fontdrvhost.exe 3040 fontdrvhost.exe 2664 fontdrvhost.exe 3184 fontdrvhost.exe 920 fontdrvhost.exe 3828 fontdrvhost.exe 3556 fontdrvhost.exe 1692 fontdrvhost.exe 5572 fontdrvhost.exe 1500 fontdrvhost.exe 3752 fontdrvhost.exe - Modifies registry class 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Windows.RuntimeHost.5\CLSID\ = "{85F480D5-3F52-43FE-8222-E130F11DA460}" 2026-08-19_d7ec31427f9c7895d1cf9e856cd3780a_cobalt-strike_icedid_ryuk.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{85F480D5-3F52-43FE-8222-E130F11DA460} 2026-08-19_d7ec31427f9c7895d1cf9e856cd3780a_cobalt-strike_icedid_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85F480D5-3F52-43FE-8222-E130F11DA460}\ = "Usermode Font Driver Host" 2026-08-19_d7ec31427f9c7895d1cf9e856cd3780a_cobalt-strike_icedid_ryuk.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{85F480D5-3F52-43FE-8222-E130F11DA460}\LocalServer32 2026-08-19_d7ec31427f9c7895d1cf9e856cd3780a_cobalt-strike_icedid_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85F480D5-3F52-43FE-8222-E130F11DA460}\LocalServer32\ = "\"C:\\ProgramData\\PackageCache\\Background_me8U\\fontdrvhost.exe\" -Embedding" 2026-08-19_d7ec31427f9c7895d1cf9e856cd3780a_cobalt-strike_icedid_ryuk.exe Key created \REGISTRY\MACHINE\Software\Classes\Microsoft.Windows.RuntimeHost.5 2026-08-19_d7ec31427f9c7895d1cf9e856cd3780a_cobalt-strike_icedid_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Windows.RuntimeHost.5\ = "Usermode Font Driver Host" 2026-08-19_d7ec31427f9c7895d1cf9e856cd3780a_cobalt-strike_icedid_ryuk.exe Key created \REGISTRY\MACHINE\Software\Classes\Microsoft.Windows.RuntimeHost.5\CLSID 2026-08-19_d7ec31427f9c7895d1cf9e856cd3780a_cobalt-strike_icedid_ryuk.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4780 fontdrvhost.exe 4780 fontdrvhost.exe 2612 fontdrvhost.exe 2612 fontdrvhost.exe 3468 fontdrvhost.exe 3468 fontdrvhost.exe 2552 fontdrvhost.exe 2552 fontdrvhost.exe 5920 fontdrvhost.exe 5920 fontdrvhost.exe 4648 fontdrvhost.exe 4648 fontdrvhost.exe 4784 fontdrvhost.exe 4784 fontdrvhost.exe 468 fontdrvhost.exe 468 fontdrvhost.exe 1620 fontdrvhost.exe 1620 fontdrvhost.exe 6136 fontdrvhost.exe 6136 fontdrvhost.exe 1196 fontdrvhost.exe 1196 fontdrvhost.exe 5756 fontdrvhost.exe 5756 fontdrvhost.exe 3112 fontdrvhost.exe 3112 fontdrvhost.exe 1948 fontdrvhost.exe 1948 fontdrvhost.exe 1740 fontdrvhost.exe 1740 fontdrvhost.exe 4252 fontdrvhost.exe 4252 fontdrvhost.exe 1972 fontdrvhost.exe 1972 fontdrvhost.exe 2064 fontdrvhost.exe 2064 fontdrvhost.exe 2900 fontdrvhost.exe 2900 fontdrvhost.exe 1472 fontdrvhost.exe 1472 fontdrvhost.exe 3532 fontdrvhost.exe 3532 fontdrvhost.exe 6000 fontdrvhost.exe 6000 fontdrvhost.exe 4064 fontdrvhost.exe 4064 fontdrvhost.exe 5896 fontdrvhost.exe 5896 fontdrvhost.exe 2784 fontdrvhost.exe 2784 fontdrvhost.exe 4348 fontdrvhost.exe 4348 fontdrvhost.exe 5964 fontdrvhost.exe 5964 fontdrvhost.exe 4244 fontdrvhost.exe 4244 fontdrvhost.exe 3736 fontdrvhost.exe 3736 fontdrvhost.exe 2104 fontdrvhost.exe 2104 fontdrvhost.exe 3684 fontdrvhost.exe 3684 fontdrvhost.exe 4120 fontdrvhost.exe 4120 fontdrvhost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2864 fontdrvhost.exe Token: SeImpersonatePrivilege 2864 fontdrvhost.exe Token: SeAssignPrimaryTokenPrivilege 2864 fontdrvhost.exe Token: SeDebugPrivilege 4780 fontdrvhost.exe Token: SeImpersonatePrivilege 4780 fontdrvhost.exe Token: SeAssignPrimaryTokenPrivilege 4780 fontdrvhost.exe Token: SeDebugPrivilege 2612 fontdrvhost.exe Token: SeImpersonatePrivilege 2612 fontdrvhost.exe Token: SeAssignPrimaryTokenPrivilege 2612 fontdrvhost.exe Token: SeDebugPrivilege 3468 fontdrvhost.exe Token: SeImpersonatePrivilege 3468 fontdrvhost.exe Token: SeAssignPrimaryTokenPrivilege 3468 fontdrvhost.exe Token: SeDebugPrivilege 2552 fontdrvhost.exe Token: SeImpersonatePrivilege 2552 fontdrvhost.exe Token: SeAssignPrimaryTokenPrivilege 2552 fontdrvhost.exe Token: SeDebugPrivilege 5920 fontdrvhost.exe Token: SeImpersonatePrivilege 5920 fontdrvhost.exe Token: SeAssignPrimaryTokenPrivilege 5920 fontdrvhost.exe Token: SeDebugPrivilege 4648 fontdrvhost.exe Token: SeImpersonatePrivilege 4648 fontdrvhost.exe Token: SeAssignPrimaryTokenPrivilege 4648 fontdrvhost.exe Token: SeDebugPrivilege 4784 fontdrvhost.exe Token: SeImpersonatePrivilege 4784 fontdrvhost.exe Token: SeAssignPrimaryTokenPrivilege 4784 fontdrvhost.exe Token: SeDebugPrivilege 468 fontdrvhost.exe Token: SeImpersonatePrivilege 468 fontdrvhost.exe Token: SeAssignPrimaryTokenPrivilege 468 fontdrvhost.exe Token: SeDebugPrivilege 1620 fontdrvhost.exe Token: SeImpersonatePrivilege 1620 fontdrvhost.exe Token: SeAssignPrimaryTokenPrivilege 1620 fontdrvhost.exe Token: SeDebugPrivilege 6136 fontdrvhost.exe Token: SeImpersonatePrivilege 6136 fontdrvhost.exe Token: SeAssignPrimaryTokenPrivilege 6136 fontdrvhost.exe Token: SeDebugPrivilege 1196 fontdrvhost.exe Token: SeImpersonatePrivilege 1196 fontdrvhost.exe Token: SeAssignPrimaryTokenPrivilege 1196 fontdrvhost.exe Token: SeDebugPrivilege 5756 fontdrvhost.exe Token: SeImpersonatePrivilege 5756 fontdrvhost.exe Token: SeAssignPrimaryTokenPrivilege 5756 fontdrvhost.exe Token: SeDebugPrivilege 3112 fontdrvhost.exe Token: SeImpersonatePrivilege 3112 fontdrvhost.exe Token: SeAssignPrimaryTokenPrivilege 3112 fontdrvhost.exe Token: SeDebugPrivilege 1948 fontdrvhost.exe Token: SeImpersonatePrivilege 1948 fontdrvhost.exe Token: SeAssignPrimaryTokenPrivilege 1948 fontdrvhost.exe Token: SeDebugPrivilege 1740 fontdrvhost.exe Token: SeImpersonatePrivilege 1740 fontdrvhost.exe Token: SeAssignPrimaryTokenPrivilege 1740 fontdrvhost.exe Token: SeDebugPrivilege 4252 fontdrvhost.exe Token: SeImpersonatePrivilege 4252 fontdrvhost.exe Token: SeAssignPrimaryTokenPrivilege 4252 fontdrvhost.exe Token: SeDebugPrivilege 1972 fontdrvhost.exe Token: SeImpersonatePrivilege 1972 fontdrvhost.exe Token: SeAssignPrimaryTokenPrivilege 1972 fontdrvhost.exe Token: SeDebugPrivilege 2064 fontdrvhost.exe Token: SeImpersonatePrivilege 2064 fontdrvhost.exe Token: SeAssignPrimaryTokenPrivilege 2064 fontdrvhost.exe Token: SeDebugPrivilege 2900 fontdrvhost.exe Token: SeImpersonatePrivilege 2900 fontdrvhost.exe Token: SeAssignPrimaryTokenPrivilege 2900 fontdrvhost.exe Token: SeDebugPrivilege 1472 fontdrvhost.exe Token: SeImpersonatePrivilege 1472 fontdrvhost.exe Token: SeAssignPrimaryTokenPrivilege 1472 fontdrvhost.exe Token: SeDebugPrivilege 3532 fontdrvhost.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3008 wrote to memory of 4592 3008 2026-08-19_d7ec31427f9c7895d1cf9e856cd3780a_cobalt-strike_icedid_ryuk.exe 89 PID 4592 wrote to memory of 5096 4592 fontdrvhost.exe 90 PID 5096 wrote to memory of 260 5096 fontdrvhost.exe 91 PID 4592 wrote to memory of 2844 4592 fontdrvhost.exe 93 PID 2844 wrote to memory of 5424 2844 fontdrvhost.exe 94 PID 5424 wrote to memory of 756 5424 svc_cache_2844.exe 95 PID 756 wrote to memory of 2124 756 svc_cache_5424.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_d7ec31427f9c7895d1cf9e856cd3780a_cobalt-strike_icedid_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_d7ec31427f9c7895d1cf9e856cd3780a_cobalt-strike_icedid_ryuk.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"3⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\ProgramData\PackageCache\Background_me8U\svc_cache_5096.exe"C:\ProgramData\PackageCache\Background_me8U\svc_cache_5096.exe"4⤵
- Executes dropped EXE
PID:260
-
-
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"3⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\ProgramData\PackageCache\Background_me8U\svc_cache_2844.exe"C:\ProgramData\PackageCache\Background_me8U\svc_cache_2844.exe"4⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\ProgramData\PackageCache\Background_me8U\svc_cache_5424.exe"C:\ProgramData\PackageCache\Background_me8U\svc_cache_5424.exe"5⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\ProgramData\PackageCache\Background_me8U\svc_cache_756.exe"C:\ProgramData\PackageCache\Background_me8U\svc_cache_756.exe"6⤵
- Executes dropped EXE
PID:2124
-
-
-
-
-
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2864 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4780 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2612 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3468 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2552 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5920 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4648 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4784 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:468 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding10⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1620 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6136 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding12⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1196 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5756 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding14⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3112 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1948 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding16⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1740 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4252 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding18⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1972 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2064 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding20⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2900 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1472 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding22⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3532 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:6000 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding24⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4064 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5896 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding26⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2784 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4348 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding28⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5964 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4244 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding30⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3736 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2104 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding32⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3684 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4120 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding34⤵
- Executes dropped EXE
PID:1192 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding35⤵
- Executes dropped EXE
PID:3388 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding36⤵
- Executes dropped EXE
PID:3564 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding37⤵
- Executes dropped EXE
PID:3628 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding38⤵
- Executes dropped EXE
PID:3240 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding39⤵
- Executes dropped EXE
PID:1164 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding40⤵
- Executes dropped EXE
PID:2324 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding41⤵
- Executes dropped EXE
PID:3076 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding42⤵
- Executes dropped EXE
PID:5052 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding43⤵
- Executes dropped EXE
PID:4892 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding44⤵
- Executes dropped EXE
PID:948 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding45⤵
- Executes dropped EXE
PID:1444 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding46⤵
- Executes dropped EXE
PID:2496 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding47⤵
- Executes dropped EXE
PID:2896 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding48⤵
- Executes dropped EXE
PID:3040 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding49⤵
- Executes dropped EXE
PID:2664 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding50⤵
- Executes dropped EXE
PID:3184 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding51⤵
- Executes dropped EXE
PID:920 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding52⤵
- Executes dropped EXE
PID:3828 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding53⤵
- Executes dropped EXE
PID:3556 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding54⤵
- Executes dropped EXE
PID:1692 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding55⤵
- Executes dropped EXE
PID:5572 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding56⤵
- Executes dropped EXE
PID:1500 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding57⤵
- Executes dropped EXE
PID:3752 -
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding58⤵PID:3048
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding59⤵PID:480
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding60⤵PID:1180
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding61⤵PID:4056
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding62⤵PID:3484
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding63⤵PID:1236
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding64⤵PID:6080
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding65⤵PID:4304
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding66⤵PID:6128
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding67⤵PID:5696
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding68⤵PID:4240
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding69⤵PID:2812
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding70⤵PID:2996
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding71⤵PID:2236
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding72⤵PID:1144
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding73⤵PID:3064
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding74⤵PID:5396
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding75⤵PID:5840
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding76⤵PID:3472
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding77⤵PID:5308
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding78⤵PID:5292
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding79⤵PID:3652
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding80⤵PID:2956
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding81⤵PID:3824
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding82⤵PID:4148
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding83⤵PID:2172
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding84⤵PID:6116
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding85⤵PID:4392
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding86⤵PID:4076
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding87⤵PID:5624
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding88⤵PID:3324
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding89⤵PID:3060
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding90⤵PID:3356
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding91⤵PID:3424
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding92⤵PID:1928
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding93⤵PID:1296
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding94⤵PID:360
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding95⤵PID:6120
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding96⤵PID:4940
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding97⤵PID:1060
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding98⤵PID:1884
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding99⤵PID:1812
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding100⤵PID:2100
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding101⤵PID:1124
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding102⤵PID:2492
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding103⤵PID:4956
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding104⤵PID:2980
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding105⤵PID:3316
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding106⤵PID:4664
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding107⤵PID:3384
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding108⤵PID:4908
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding109⤵PID:3004
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding110⤵PID:3088
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding111⤵PID:4300
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding112⤵PID:4616
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding113⤵PID:704
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding114⤵PID:1888
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding115⤵PID:5136
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding116⤵PID:4816
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding117⤵PID:3352
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding118⤵PID:4620
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding119⤵PID:5664
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding120⤵PID:1800
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding121⤵PID:1716
-
C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe"C:\ProgramData\PackageCache\Background_me8U\fontdrvhost.exe" -Embedding122⤵PID:1284
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-