Analysis
- max time kernel
299s - max time network
92s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
27/08/2026, 20:35
General
- Target ba32c7c9cff1ab6bfaec392113e945bbff1104d051c224c5324954ad231c2fe3.exe
- Size 312KB
- Sample260827-zc4pcaba46
- SHA256 ba32c7c9cff1ab6bfaec392113e945bbff1104d051c224c5324954ad231c2fe3
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 64 IoCs
- Adds Run key to start application 2 TTPs 64 IoCs
- Suspicious use of SetThreadContext 60 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba32c7c9cff1ab6bfaec392113e945bbff1104d051c224c5324954ad231c2fe3.exe"C:\Users\Admin\AppData\Local\Temp\ba32c7c9cff1ab6bfaec392113e945bbff1104d051c224c5324954ad231c2fe3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Deletes itself
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"5⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"7⤵
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"6⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"7⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"9⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"10⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"12⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"13⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"14⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"15⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"16⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"17⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"18⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"19⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"20⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"21⤵
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe19⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"19⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"20⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"21⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"22⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"23⤵
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe21⤵
-
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe16⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"16⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"17⤵
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe13⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"13⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe10⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"11⤵
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exeC:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"3⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"5⤵
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"7⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"8⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"10⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"11⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"13⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"14⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"15⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"16⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe14⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"15⤵
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe11⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"12⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"9⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"10⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"12⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"13⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"14⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"15⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"16⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"17⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe16⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"16⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"17⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"18⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"19⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe18⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"18⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"19⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe13⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"14⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"15⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"16⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"17⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"18⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"19⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe18⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"19⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"20⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"21⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe20⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"20⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"21⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe15⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"15⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"16⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"17⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"18⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"19⤵
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe17⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"18⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"19⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"20⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"21⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"22⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"23⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"24⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"25⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"26⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"27⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"28⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"29⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"30⤵
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe28⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"28⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"29⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"30⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"31⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe30⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"30⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"31⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"32⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"33⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"34⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"35⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"36⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"37⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"38⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"39⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"40⤵
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe38⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"38⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"39⤵
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"35⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"36⤵
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe32⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"32⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"33⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"34⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"35⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"36⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"37⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"38⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"39⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"40⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"41⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"42⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"43⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"44⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"45⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"46⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"47⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe46⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"46⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"47⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"48⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"49⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe48⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"48⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"49⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"50⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"51⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe50⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"50⤵
-
-
-
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe43⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"43⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"44⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"45⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"46⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"47⤵
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe45⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"45⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"46⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"47⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"48⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"49⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"50⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"51⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe50⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"50⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"51⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"52⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"53⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe52⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"52⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"53⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"54⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"55⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"56⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"57⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"58⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe57⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"57⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"58⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"59⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"60⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe59⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"59⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"60⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"61⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"62⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"63⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"64⤵
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe64⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"64⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"65⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"66⤵
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe66⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"66⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"67⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"68⤵
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe68⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"68⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"69⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"70⤵
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe70⤵
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe61⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"61⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"62⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"63⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"64⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"65⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"66⤵
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe66⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"66⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"67⤵
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe63⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"63⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"64⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"65⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"66⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe65⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"65⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"66⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"67⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"68⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe67⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"67⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"68⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"69⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"70⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"71⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"72⤵
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe72⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"72⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"73⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"74⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe74⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"74⤵
-
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe69⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"69⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"70⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"71⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"72⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe71⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"71⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"72⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"73⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"74⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe73⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"73⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"74⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"75⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"76⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe75⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"75⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"76⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"77⤵
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe77⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"77⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"78⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"79⤵
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe79⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"79⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"80⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe54⤵
-
-
-
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe47⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"47⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"48⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"49⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"50⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe49⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"49⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"50⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"51⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"52⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"53⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe51⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"51⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"52⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe40⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"40⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"41⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"42⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"43⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"44⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe42⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"42⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"43⤵
-
-
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe37⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"37⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"38⤵
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe34⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"34⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"35⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"36⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"37⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"38⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"39⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"40⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"41⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"42⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"43⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"44⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"45⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"46⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"47⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe45⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"45⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"46⤵
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe42⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"42⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"43⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"44⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"45⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"46⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"47⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"48⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"49⤵
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe47⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"47⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"48⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"49⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"50⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe49⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"49⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"50⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"51⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"52⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe51⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"51⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"52⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"53⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"54⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe53⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"53⤵
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe44⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"44⤵
-
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe39⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"39⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"40⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"41⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"42⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"43⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"44⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"45⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe44⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"44⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"45⤵
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe41⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"41⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"42⤵
-
-
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe36⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"36⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"37⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"38⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"39⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"40⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"41⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"42⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"43⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"44⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"45⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"46⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe44⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"44⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"45⤵
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe41⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"41⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"42⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"43⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"44⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"45⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"46⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"47⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe46⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"46⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"47⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"48⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"49⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe48⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"48⤵
-
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe43⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"43⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"44⤵
-
-
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe38⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"38⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe25⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"25⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"26⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"27⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"28⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"29⤵
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe27⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"27⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"28⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"29⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"30⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"31⤵
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe29⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"29⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"30⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"31⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"32⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"33⤵
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe31⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"31⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"32⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"33⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"34⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe33⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"33⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"34⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"35⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"36⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"37⤵
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"35⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"36⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"37⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"38⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"39⤵
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe37⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"37⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"38⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"39⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"40⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"41⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"42⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"43⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"44⤵
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe42⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"42⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"43⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"44⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"45⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"46⤵
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe44⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"44⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"45⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"46⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"47⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"48⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"49⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"50⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"51⤵
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe49⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"49⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"50⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"51⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"52⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"53⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"54⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"55⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"56⤵
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe54⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"54⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"55⤵
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe51⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"51⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"52⤵
-
-
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe46⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"46⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"47⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"48⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"49⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"50⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"51⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"52⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"53⤵
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe51⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"51⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"52⤵
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe48⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"48⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"49⤵
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe39⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"39⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"40⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"41⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"42⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe41⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"41⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"42⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"43⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"44⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"45⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"46⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"47⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"48⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe46⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"46⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"47⤵
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe43⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"43⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"44⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe22⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"22⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"23⤵
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe19⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"19⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"20⤵
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe10⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"12⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"14⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"15⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"16⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"17⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"18⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"19⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe18⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"19⤵
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe15⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"16⤵
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe12⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"13⤵
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"6⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"7⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"9⤵
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"8⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"9⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"11⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"12⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"14⤵
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe12⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"13⤵
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"10⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"11⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"14⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"16⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"17⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"18⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"19⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"20⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"21⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe20⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"20⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"21⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"22⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"23⤵
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe22⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"22⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"23⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe17⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"17⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"18⤵
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe14⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"15⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"16⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"17⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe16⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"16⤵
- Executes dropped EXE
-
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe11⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"12⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"13⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"15⤵
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe13⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"14⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"15⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"17⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"18⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"19⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"20⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"21⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"22⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"23⤵
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe21⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"21⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"22⤵
-
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe18⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"18⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe15⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"16⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"17⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"19⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"20⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"21⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"22⤵
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe20⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"20⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe17⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"18⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"19⤵
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"20⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe19⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"C:\Users\Admin\AppData\Local\Microsoft\e720a209-9121-2436-9052-c82b2f7ac4dd\09df994e-2de9-4d22-84af-6520af552c3e.exe"19⤵
- Executes dropped EXE
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
55b129c4-8bb8-225f-909a-6c8709f8a2c9
55b129c4-8bb8-225f-909a-6c8709f8a2c9
55b129c4-8bb8-225f-909a-6c8709f8a2c9
55b129c4-8bb8-225f-909a-6c8709f8a2c9
55b129c4-8bb8-225f-909a-6c8709f8a2c9
55b129c4-8bb8-225f-909a-6c8709f8a2c9
55b129c4-8bb8-225f-909a-6c8709f8a2c9
55b129c4-8bb8-225f-909a-6c8709f8a2c9
55b129c4-8bb8-225f-909a-6c8709f8a2c9
55b129c4-8bb8-225f-909a-6c8709f8a2c9
55b129c4-8bb8-225f-909a-6c8709f8a2c9
55b129c4-8bb8-225f-909a-6c8709f8a2c9
55b129c4-8bb8-225f-909a-6c8709f8a2c9
55b129c4-8bb8-225f-909a-6c8709f8a2c9
55b129c4-8bb8-225f-909a-6c8709f8a2c9
55b129c4-8bb8-225f-909a-6c8709f8a2c9
55b129c4-8bb8-225f-909a-6c8709f8a2c9
55b129c4-8bb8-225f-909a-6c8709f8a2c9
55b129c4-8bb8-225f-909a-6c8709f8a2c9
b4999d5e-bcc0-2585-82ed-e2b25f0ee43f
flag
09df994e-2de9-4d22-84af-6520af552c3e.exe
memory/468-356-0x0000000000A00000-0x0000000000A9F000-memory.dmp
memory/468-355-0x0000000000A00000-0x0000000000A9F000-memory.dmp
memory/476-85-0x0000000000D00000-0x0000000000D01000-memory.dmp
memory/604-57-0x0000000000510000-0x00000000005AF000-memory.dmp
memory/604-58-0x0000000000510000-0x00000000005AF000-memory.dmp
memory/764-25-0x0000000000C00000-0x0000000000C9F000-memory.dmp
memory/764-32-0x0000000000DF0000-0x0000000000DF1000-memory.dmp
memory/764-31-0x0000000000C00000-0x0000000000C9F000-memory.dmp
memory/764-33-0x0000000000C00000-0x0000000000C9F000-memory.dmp
memory/764-40-0x0000000003880000-0x0000000003881000-memory.dmp
memory/888-104-0x0000000000C00000-0x0000000000C9F000-memory.dmp
memory/888-105-0x0000000000C00000-0x0000000000C9F000-memory.dmp
memory/904-583-0x0000000000A40000-0x0000000000ADF000-memory.dmp
memory/904-582-0x0000000000A40000-0x0000000000ADF000-memory.dmp
memory/1512-80-0x0000000001210000-0x00000000012AF000-memory.dmp
memory/1512-79-0x0000000001210000-0x00000000012AF000-memory.dmp
memory/1620-127-0x0000000000A00000-0x0000000000A9F000-memory.dmp
memory/1620-126-0x0000000000A00000-0x0000000000A9F000-memory.dmp
memory/1776-269-0x0000000000A00000-0x0000000000A9F000-memory.dmp
memory/1776-268-0x0000000000A00000-0x0000000000A9F000-memory.dmp
memory/1816-338-0x0000000000D30000-0x0000000000DCF000-memory.dmp
memory/1816-337-0x0000000000D30000-0x0000000000DCF000-memory.dmp
memory/1952-507-0x0000000000E20000-0x0000000000EBF000-memory.dmp
memory/1952-505-0x0000000000E20000-0x0000000000EBF000-memory.dmp
memory/2072-545-0x0000000001200000-0x000000000129F000-memory.dmp
memory/2072-546-0x0000000001200000-0x000000000129F000-memory.dmp
memory/2088-395-0x0000000000E80000-0x0000000000F1F000-memory.dmp
memory/2088-394-0x0000000000E80000-0x0000000000F1F000-memory.dmp
memory/2192-374-0x0000000001200000-0x000000000129F000-memory.dmp
memory/2192-375-0x0000000001200000-0x000000000129F000-memory.dmp
memory/2204-20-0x0000000000B10000-0x0000000000BAF000-memory.dmp
memory/2204-22-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/2204-21-0x0000000002830000-0x00000000028CF000-memory.dmp
memory/2420-316-0x0000000000410000-0x00000000004AF000-memory.dmp
memory/2420-317-0x0000000000410000-0x00000000004AF000-memory.dmp
memory/2428-413-0x0000000000800000-0x000000000089F000-memory.dmp
memory/2428-412-0x0000000000800000-0x000000000089F000-memory.dmp
memory/2756-132-0x0000000000380000-0x0000000000381000-memory.dmp
memory/2764-563-0x0000000000C80000-0x0000000000D1F000-memory.dmp
memory/2764-564-0x0000000000C80000-0x0000000000D1F000-memory.dmp
memory/2768-178-0x0000000000CF0000-0x0000000000CF1000-memory.dmp
memory/2944-39-0x0000000000330000-0x0000000000331000-memory.dmp
memory/2984-291-0x0000000000760000-0x00000000007FF000-memory.dmp
memory/2984-292-0x0000000000760000-0x00000000007FF000-memory.dmp
memory/3116-248-0x0000000000ED0000-0x0000000000ED1000-memory.dmp
memory/3352-217-0x00000000008F0000-0x000000000098F000-memory.dmp
memory/3352-218-0x00000000008F0000-0x000000000098F000-memory.dmp
memory/3512-242-0x0000000001000000-0x000000000109F000-memory.dmp
memory/3512-243-0x0000000001000000-0x000000000109F000-memory.dmp
memory/3536-38-0x0000000000800000-0x000000000089F000-memory.dmp
memory/3740-511-0x0000000000830000-0x0000000000831000-memory.dmp
memory/3788-431-0x0000000000E00000-0x0000000000E9F000-memory.dmp
memory/3788-432-0x0000000000E00000-0x0000000000E9F000-memory.dmp
memory/3920-474-0x0000000000570000-0x0000000000571000-memory.dmp
memory/3960-150-0x0000000000600000-0x000000000069F000-memory.dmp
memory/3960-149-0x0000000000600000-0x000000000069F000-memory.dmp
memory/4032-487-0x0000000000ED0000-0x0000000000F6F000-memory.dmp
memory/4032-488-0x0000000000ED0000-0x0000000000F6F000-memory.dmp
memory/4548-468-0x0000000000330000-0x00000000003CF000-memory.dmp
memory/4548-469-0x0000000000330000-0x00000000003CF000-memory.dmp
memory/4560-155-0x0000000000370000-0x0000000000371000-memory.dmp
memory/4584-525-0x0000000000C30000-0x0000000000CCF000-memory.dmp
memory/4584-524-0x0000000000C30000-0x0000000000CCF000-memory.dmp
memory/4748-455-0x0000000000AD0000-0x0000000000AD1000-memory.dmp
memory/4836-174-0x0000000000880000-0x000000000091F000-memory.dmp
memory/4836-172-0x0000000000880000-0x000000000091F000-memory.dmp
memory/4928-7-0x00000000032F0000-0x000000000338F000-memory.dmp
memory/4928-0-0x00000000015B0000-0x000000000164F000-memory.dmp
memory/4928-6-0x00000000015B0000-0x000000000164F000-memory.dmp
memory/4928-4-0x00000000013C0000-0x00000000013C1000-memory.dmp
memory/4928-3-0x00000000032F0000-0x000000000338F000-memory.dmp
memory/4940-196-0x0000000000C50000-0x0000000000CEF000-memory.dmp
memory/4940-195-0x0000000000C50000-0x0000000000CEF000-memory.dmp
memory/4980-450-0x0000000001000000-0x000000000109F000-memory.dmp
memory/4980-449-0x0000000001000000-0x000000000109F000-memory.dmp
memory/4984-9-0x0000000003400000-0x0000000003401000-memory.dmp
memory/4984-8-0x0000000000F60000-0x0000000000FFF000-memory.dmp
memory/4984-18-0x0000000000F60000-0x0000000000FFF000-memory.dmp
memory/5116-418-0x00000000005B0000-0x00000000005B1000-memory.dmp