Analysis
-
max time kernel
153s -
max time network
138s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
29-01-2022 07:42
Static task
static1
Behavioral task
behavioral1
Sample
5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe
Resource
win10-en-20211208
General
-
Target
5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe
-
Size
6.6MB
-
MD5
041cdf8eba9e2419532fdc25df205224
-
SHA1
6e4f23723189e08d26933a0885a822c475bfc43b
-
SHA256
5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae
-
SHA512
c1223e08882b2428b439053b598d82753e02a9390e2eb3158fd4e0b55c88656d7143db4fb5d5f321bf2ff324de375f30a05b8ce7977579d802115db7b0cc1891
Malware Config
Signatures
-
Detect Neshta Payload 35 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE family_neshta C:\odt\OFFICE~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exesvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.comsvchost.comsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com5C4C1B~1.EXE5C4C1B~1.EXEsvchost.comsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.comsvchost.comsvchost.com5C4C1B~1.EXE5C4C1B~1.EXEpid process 1352 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe 920 svchost.com 1272 5C4C1B~1.EXE 3956 svchost.com 856 5C4C1B~1.EXE 3124 svchost.com 3360 5C4C1B~1.EXE 592 svchost.com 2232 5C4C1B~1.EXE 3792 svchost.com 1500 5C4C1B~1.EXE 608 svchost.com 596 5C4C1B~1.EXE 1716 svchost.com 832 5C4C1B~1.EXE 2316 svchost.com 2188 5C4C1B~1.EXE 2304 svchost.com 3008 5C4C1B~1.EXE 3144 svchost.com 1700 5C4C1B~1.EXE 2116 svchost.com 2120 5C4C1B~1.EXE 2776 svchost.com 2948 5C4C1B~1.EXE 3456 svchost.com 1860 5C4C1B~1.EXE 3536 svchost.com 3396 5C4C1B~1.EXE 3404 svchost.com 3180 5C4C1B~1.EXE 768 svchost.com 1220 5C4C1B~1.EXE 3812 svchost.com 428 5C4C1B~1.EXE 1460 svchost.com 396 5C4C1B~1.EXE 2592 svchost.com 1508 5C4C1B~1.EXE 3308 svchost.com 1092 svchost.com 2836 svchost.com 1532 5C4C1B~1.EXE 728 svchost.com 676 5C4C1B~1.EXE 1188 svchost.com 3792 5C4C1B~1.EXE 1304 svchost.com 1084 svchost.com 1256 svchost.com 1716 svchost.com 1428 svchost.com 1244 5C4C1B~1.EXE 2188 5C4C1B~1.EXE 1852 svchost.com 1456 svchost.com 1752 5C4C1B~1.EXE 1552 svchost.com 2124 5C4C1B~1.EXE 2220 svchost.com 2036 svchost.com 2820 svchost.com 3064 5C4C1B~1.EXE 1584 5C4C1B~1.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exedescription ioc process File opened for modification C:\PROGRA~2\WINDOW~2\WinMail.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\WINDOW~2\WinMail.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe -
Drops file in Windows directory 64 IoCs
Processes:
svchost.comsvchost.comsvchost.com5C4C1B~1.EXE5C4C1B~1.EXEsvchost.comsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.comsvchost.comsvchost.com5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.comsvchost.comsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.comsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.comsvchost.comdescription ioc process File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys 5C4C1B~1.EXE File opened for modification C:\Windows\svchost.com 5C4C1B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 5C4C1B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 5C4C1B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys 5C4C1B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 5C4C1B~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys 5C4C1B~1.EXE File opened for modification C:\Windows\directx.sys 5C4C1B~1.EXE File opened for modification C:\Windows\directx.sys 5C4C1B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys 5C4C1B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 5C4C1B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com 5C4C1B~1.EXE File opened for modification C:\Windows\directx.sys 5C4C1B~1.EXE File opened for modification C:\Windows\directx.sys 5C4C1B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 5C4C1B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 5C4C1B~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 5C4C1B~1.EXE File opened for modification C:\Windows\directx.sys 5C4C1B~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys 5C4C1B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 5C4C1B~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
Processes:
5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXEsvchost.com5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXEsvchost.com5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXEsvchost.com5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings svchost.com Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings svchost.com Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings svchost.com Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 5C4C1B~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exesvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEdescription pid process target process PID 3716 wrote to memory of 1352 3716 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe PID 3716 wrote to memory of 1352 3716 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe PID 3716 wrote to memory of 1352 3716 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe PID 1352 wrote to memory of 920 1352 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe svchost.com PID 1352 wrote to memory of 920 1352 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe svchost.com PID 1352 wrote to memory of 920 1352 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe svchost.com PID 920 wrote to memory of 1272 920 svchost.com 5C4C1B~1.EXE PID 920 wrote to memory of 1272 920 svchost.com 5C4C1B~1.EXE PID 920 wrote to memory of 1272 920 svchost.com 5C4C1B~1.EXE PID 1272 wrote to memory of 3956 1272 5C4C1B~1.EXE svchost.com PID 1272 wrote to memory of 3956 1272 5C4C1B~1.EXE svchost.com PID 1272 wrote to memory of 3956 1272 5C4C1B~1.EXE svchost.com PID 3956 wrote to memory of 856 3956 svchost.com 5C4C1B~1.EXE PID 3956 wrote to memory of 856 3956 svchost.com 5C4C1B~1.EXE PID 3956 wrote to memory of 856 3956 svchost.com 5C4C1B~1.EXE PID 856 wrote to memory of 3124 856 5C4C1B~1.EXE svchost.com PID 856 wrote to memory of 3124 856 5C4C1B~1.EXE svchost.com PID 856 wrote to memory of 3124 856 5C4C1B~1.EXE svchost.com PID 3124 wrote to memory of 3360 3124 svchost.com 5C4C1B~1.EXE PID 3124 wrote to memory of 3360 3124 svchost.com 5C4C1B~1.EXE PID 3124 wrote to memory of 3360 3124 svchost.com 5C4C1B~1.EXE PID 3360 wrote to memory of 592 3360 5C4C1B~1.EXE svchost.com PID 3360 wrote to memory of 592 3360 5C4C1B~1.EXE svchost.com PID 3360 wrote to memory of 592 3360 5C4C1B~1.EXE svchost.com PID 592 wrote to memory of 2232 592 svchost.com 5C4C1B~1.EXE PID 592 wrote to memory of 2232 592 svchost.com 5C4C1B~1.EXE PID 592 wrote to memory of 2232 592 svchost.com 5C4C1B~1.EXE PID 2232 wrote to memory of 3792 2232 5C4C1B~1.EXE svchost.com PID 2232 wrote to memory of 3792 2232 5C4C1B~1.EXE svchost.com PID 2232 wrote to memory of 3792 2232 5C4C1B~1.EXE svchost.com PID 3792 wrote to memory of 1500 3792 svchost.com 5C4C1B~1.EXE PID 3792 wrote to memory of 1500 3792 svchost.com 5C4C1B~1.EXE PID 3792 wrote to memory of 1500 3792 svchost.com 5C4C1B~1.EXE PID 1500 wrote to memory of 608 1500 5C4C1B~1.EXE svchost.com PID 1500 wrote to memory of 608 1500 5C4C1B~1.EXE svchost.com PID 1500 wrote to memory of 608 1500 5C4C1B~1.EXE svchost.com PID 608 wrote to memory of 596 608 svchost.com 5C4C1B~1.EXE PID 608 wrote to memory of 596 608 svchost.com 5C4C1B~1.EXE PID 608 wrote to memory of 596 608 svchost.com 5C4C1B~1.EXE PID 596 wrote to memory of 1716 596 5C4C1B~1.EXE svchost.com PID 596 wrote to memory of 1716 596 5C4C1B~1.EXE svchost.com PID 596 wrote to memory of 1716 596 5C4C1B~1.EXE svchost.com PID 1716 wrote to memory of 832 1716 svchost.com 5C4C1B~1.EXE PID 1716 wrote to memory of 832 1716 svchost.com 5C4C1B~1.EXE PID 1716 wrote to memory of 832 1716 svchost.com 5C4C1B~1.EXE PID 832 wrote to memory of 2316 832 5C4C1B~1.EXE svchost.com PID 832 wrote to memory of 2316 832 5C4C1B~1.EXE svchost.com PID 832 wrote to memory of 2316 832 5C4C1B~1.EXE svchost.com PID 2316 wrote to memory of 2188 2316 svchost.com 5C4C1B~1.EXE PID 2316 wrote to memory of 2188 2316 svchost.com 5C4C1B~1.EXE PID 2316 wrote to memory of 2188 2316 svchost.com 5C4C1B~1.EXE PID 2188 wrote to memory of 2304 2188 5C4C1B~1.EXE svchost.com PID 2188 wrote to memory of 2304 2188 5C4C1B~1.EXE svchost.com PID 2188 wrote to memory of 2304 2188 5C4C1B~1.EXE svchost.com PID 2304 wrote to memory of 3008 2304 svchost.com 5C4C1B~1.EXE PID 2304 wrote to memory of 3008 2304 svchost.com 5C4C1B~1.EXE PID 2304 wrote to memory of 3008 2304 svchost.com 5C4C1B~1.EXE PID 3008 wrote to memory of 3144 3008 5C4C1B~1.EXE svchost.com PID 3008 wrote to memory of 3144 3008 5C4C1B~1.EXE svchost.com PID 3008 wrote to memory of 3144 3008 5C4C1B~1.EXE svchost.com PID 3144 wrote to memory of 1700 3144 svchost.com 5C4C1B~1.EXE PID 3144 wrote to memory of 1700 3144 svchost.com 5C4C1B~1.EXE PID 3144 wrote to memory of 1700 3144 svchost.com 5C4C1B~1.EXE PID 1700 wrote to memory of 2116 1700 5C4C1B~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe"C:\Users\Admin\AppData\Local\Temp\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE16⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"23⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE24⤵
- Executes dropped EXE
PID:2120 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"25⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE26⤵
- Executes dropped EXE
PID:2948 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"27⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE28⤵
- Executes dropped EXE
PID:1860 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"29⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE30⤵
- Executes dropped EXE
PID:3396 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"31⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE32⤵
- Executes dropped EXE
- Modifies registry class
PID:3180 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"33⤵
- Executes dropped EXE
PID:768 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE34⤵
- Executes dropped EXE
PID:1220 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"35⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE36⤵
- Executes dropped EXE
PID:428 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"37⤵
- Executes dropped EXE
PID:1460
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE1⤵
- Executes dropped EXE
PID:396 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"2⤵
- Executes dropped EXE
PID:2592
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE1⤵
- Executes dropped EXE
PID:1508 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"2⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE3⤵PID:1092
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"4⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1532 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"6⤵
- Executes dropped EXE
PID:728 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE7⤵
- Executes dropped EXE
PID:676 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"8⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE9⤵
- Executes dropped EXE
PID:3792 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"10⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE11⤵PID:1084
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"12⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE13⤵PID:1716
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"14⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE15⤵
- Executes dropped EXE
PID:1244 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"16⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE17⤵PID:1852
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"18⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE19⤵
- Executes dropped EXE
PID:1752 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"20⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE21⤵
- Executes dropped EXE
PID:2124 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"22⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE23⤵PID:2036
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"24⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE25⤵
- Executes dropped EXE
PID:3064 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"26⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE27⤵PID:704
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"28⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE29⤵PID:3532
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"30⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE31⤵PID:3156
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"32⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE33⤵PID:3404
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"34⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE35⤵PID:768
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"36⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE37⤵
- Modifies registry class
PID:524 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"38⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE39⤵PID:648
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"40⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE41⤵PID:1844
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"42⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE43⤵
- Modifies registry class
PID:508 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"44⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE45⤵PID:2232
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"46⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE47⤵PID:1392
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"48⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE49⤵PID:2640
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"50⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE51⤵PID:2976
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"52⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE53⤵PID:2324
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"54⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE55⤵PID:1324
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"56⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE57⤵PID:1588
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"58⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE59⤵
- Executes dropped EXE
PID:2188 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"60⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE61⤵PID:2292
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"62⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE63⤵PID:3728
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"64⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE65⤵PID:2776
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"66⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE67⤵PID:2224
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"68⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE69⤵
- Executes dropped EXE
PID:1584 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"70⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE71⤵PID:2808
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"72⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE73⤵
- Modifies registry class
PID:2792 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"74⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE75⤵PID:3160
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"76⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE77⤵PID:1756
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"78⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE79⤵PID:512
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"80⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE81⤵PID:3152
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"82⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE83⤵PID:1844
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"84⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE85⤵PID:3304
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"86⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE87⤵PID:2232
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"88⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE89⤵PID:1392
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"90⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE91⤵PID:2640
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"92⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE93⤵PID:2396
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"94⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE95⤵PID:1084
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"96⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE97⤵PID:1324
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"98⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE99⤵PID:1588
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"100⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE101⤵PID:1852
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"102⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE103⤵PID:2292
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"104⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE105⤵PID:2276
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"106⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE107⤵PID:2432
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"108⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE109⤵PID:3004
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"110⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE111⤵PID:1584
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"112⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE113⤵PID:3532
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"114⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE115⤵PID:1512
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"116⤵
- Drops file in Windows directory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE117⤵PID:1200
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"118⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE119⤵PID:1756
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"120⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE121⤵PID:3472
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"122⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE123⤵PID:1348
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"124⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE125⤵PID:3312
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"126⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE127⤵PID:804
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"128⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE129⤵PID:1036
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"130⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE131⤵PID:1268
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"132⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE133⤵PID:708
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"134⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE135⤵PID:2308
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"136⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE137⤵PID:3756
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"138⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE139⤵PID:1244
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"140⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE141⤵PID:1576
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"142⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE143⤵PID:1552
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"144⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE145⤵PID:3228
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"146⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE147⤵PID:2220
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"148⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE149⤵
- Modifies registry class
PID:1840 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"150⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE151⤵PID:1312
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"152⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE153⤵PID:3096
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"154⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE155⤵PID:4056
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"156⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE157⤵PID:1512
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"158⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE159⤵PID:2404
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"160⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE161⤵PID:396
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"162⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE163⤵PID:3592
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"164⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE165⤵PID:4012
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"166⤵
- Modifies registry class
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE167⤵PID:3304
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"168⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE169⤵PID:2232
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"170⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE171⤵PID:1932
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"172⤵
- Drops file in Windows directory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE173⤵PID:1196
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"174⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE175⤵PID:1212
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"176⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE177⤵PID:2024
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"178⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE179⤵PID:1324
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"180⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE181⤵PID:1700
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"182⤵
- Modifies registry class
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE183⤵PID:1948
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"184⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE185⤵PID:2700
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"186⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE187⤵PID:2276
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"188⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE189⤵PID:2236
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"190⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE191⤵PID:1308
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"192⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE193⤵PID:3596
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"194⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE195⤵PID:1116
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"196⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE197⤵PID:1052
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"198⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE199⤵PID:3916
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"200⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE201⤵PID:304
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"202⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE203⤵PID:512
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"204⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE205⤵PID:3376
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"206⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE207⤵
- Modifies registry class
PID:3444 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"208⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE209⤵PID:3312
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"210⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE211⤵PID:404
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"212⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE213⤵PID:1020
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"214⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE215⤵PID:2316
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"216⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE217⤵PID:1184
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"218⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE219⤵PID:1868
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"220⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE221⤵PID:3756
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"222⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE223⤵PID:2116
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"224⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE225⤵PID:3228
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"226⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE227⤵PID:2220
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"228⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE229⤵
- Modifies registry class
PID:2948 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"230⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE231⤵PID:2236
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"232⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE233⤵PID:1308
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"234⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE235⤵
- Modifies registry class
PID:2088 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"236⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE237⤵PID:2156
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"238⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE239⤵PID:428
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"240⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE241⤵
- Modifies registry class
PID:1664 -