Analysis
- user interaction
yes - max time kernel
96s - max time network
65s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/10/2026, 17:35
Static task
static1
Behavioral task
behavioral1
Sample
BUILD_EXE.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
BUILD_EXE.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target BUILD_EXE.bat
- Size 906B
- Sample261026-v54gtsbe92
- SHA256 94666aa4d475219b23771da480a60f146abfe2c95062504c0544943ef62f9428
- MD5 240cf9fa46320d3bc7e6f902e8da9bf9
- SHA1 cea594e3b09a6ceb5bb44b221c8c9804e9108370
- SHA512 c13060584cc7f8478ca52f46ea039d97f663c3afeba600234b6e7b7230bae19f68197f68c17bbc6ddcbe81bc4b7a8403f373182f5163faa6127f1f948bfe6c74
- TLSH T115111E2BA26E0237A475C588AB1A05E0E90012AF12712EF419B7013C354E7C9BFCF39E
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4464 cmd.exe - Checks SCSI registry key(s) 3 TTPs 47 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A ctfmon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 ctfmon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 ctfmon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 ctfmon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A ctfmon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 ctfmon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dwm.exe - Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1536 svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 1000 taskmgr.exe Token: SeSystemProfilePrivilege 1000 taskmgr.exe Token: SeCreateGlobalPrivilege 1000 taskmgr.exe Token: SeCreateGlobalPrivilege 2432 dwm.exe Token: SeChangeNotifyPrivilege 2432 dwm.exe Token: 33 2432 dwm.exe Token: SeIncBasePriorityPrivilege 2432 dwm.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4464 wrote to memory of 5628 4464 cmd.exe 90
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\BUILD_EXE.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\system32\where.exewhere py2⤵PID:5628
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1000
-
C:\Windows\system32\ctfmon.exe/QuitInfo:000000000000026C;0000000000000270;1⤵
- Checks SCSI registry key(s)
PID:3684
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1528
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2432
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:1536