Analysis
-
max time kernel
135s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
06-02-2022 13:57
Static task
static1
Behavioral task
behavioral1
Sample
2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe
Resource
win10v2004-en-20220113
General
-
Target
2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe
-
Size
1.6MB
-
MD5
c5e204baec4a3995fd6ccaef20f0888d
-
SHA1
3e56bf9a91605df8aa6a576b5c2270c522926372
-
SHA256
2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb
-
SHA512
93163d6c30ade44906198a81905f97454881f4dcdeee6cdc8dc620d4c09a5d0e0613715214e7baabc4745bc5f9b394e4d0788e2497f179d3043a8540757a20dd
Malware Config
Signatures
-
Detect Neshta Payload 35 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\odt\OFFICE~1.EXE family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Windows\svchost.com family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exesvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.compid process 1304 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe 4624 svchost.com 1964 2C935D~1.EXE 4284 svchost.com 4388 2C935D~1.EXE 2556 svchost.com 3384 2C935D~1.EXE 4860 svchost.com 5084 2C935D~1.EXE 1228 svchost.com 1296 2C935D~1.EXE 2968 svchost.com 2296 2C935D~1.EXE 2904 svchost.com 2164 2C935D~1.EXE 4188 svchost.com 1460 2C935D~1.EXE 1180 svchost.com 176 2C935D~1.EXE 1944 svchost.com 4944 2C935D~1.EXE 3712 svchost.com 3084 2C935D~1.EXE 1900 svchost.com 3760 2C935D~1.EXE 4436 svchost.com 4664 2C935D~1.EXE 2304 svchost.com 3916 2C935D~1.EXE 504 svchost.com 4752 2C935D~1.EXE 1864 svchost.com 4068 2C935D~1.EXE 744 svchost.com 612 2C935D~1.EXE 376 svchost.com 2456 2C935D~1.EXE 700 svchost.com 2292 2C935D~1.EXE 4376 svchost.com 4568 2C935D~1.EXE 5044 svchost.com 3068 2C935D~1.EXE 820 svchost.com 64 2C935D~1.EXE 3400 svchost.com 3628 2C935D~1.EXE 3380 svchost.com 1268 2C935D~1.EXE 2768 svchost.com 2964 2C935D~1.EXE 3644 svchost.com 2576 2C935D~1.EXE 2404 svchost.com 2556 2C935D~1.EXE 4936 svchost.com 4848 2C935D~1.EXE 3616 svchost.com 4496 2C935D~1.EXE 2432 svchost.com 1416 2C935D~1.EXE 1680 svchost.com 4016 2C935D~1.EXE 2680 svchost.com -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXEdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2C935D~1.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exedescription ioc process File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MICROS~2.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\PWAHEL~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Install\{A9F77~1\EDGEMI~1.TMP\setup.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\COOKIE~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\NOTIFI~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\PWAHEL~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MIA062~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\BHO\IE_TO_~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MICROS~4.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\MSEDGE~2.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MICROS~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\msedge.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MI9C33~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\BHO\IE_TO_~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\msedge.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe -
Drops file in Windows directory 64 IoCs
Processes:
2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXEsvchost.comsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXE2C935D~1.EXE2C935D~1.EXEsvchost.comsvchost.com2C935D~1.EXE2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXEsvchost.comsvchost.comsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXE2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com2C935D~1.EXE2C935D~1.EXEsvchost.com2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXE2C935D~1.EXEsvchost.comsvchost.comsvchost.com2C935D~1.EXEsvchost.comsvchost.comdescription ioc process File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com 2C935D~1.EXE File opened for modification C:\Windows\svchost.com 2C935D~1.EXE File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\svchost.com 2C935D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\svchost.com 2C935D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\svchost.com 2C935D~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2C935D~1.EXE File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\svchost.com 2C935D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2C935D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\svchost.com 2C935D~1.EXE File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com 2C935D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\svchost.com 2C935D~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2C935D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
Processes:
2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 2C935D~1.EXE -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exedescription pid process Token: SeShutdownPrivilege 2132 svchost.exe Token: SeCreatePagefilePrivilege 2132 svchost.exe Token: SeShutdownPrivilege 2132 svchost.exe Token: SeCreatePagefilePrivilege 2132 svchost.exe Token: SeShutdownPrivilege 2132 svchost.exe Token: SeCreatePagefilePrivilege 2132 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exesvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEdescription pid process target process PID 456 wrote to memory of 1304 456 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe PID 456 wrote to memory of 1304 456 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe PID 456 wrote to memory of 1304 456 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe PID 1304 wrote to memory of 4624 1304 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe svchost.com PID 1304 wrote to memory of 4624 1304 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe svchost.com PID 1304 wrote to memory of 4624 1304 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe svchost.com PID 4624 wrote to memory of 1964 4624 svchost.com 2C935D~1.EXE PID 4624 wrote to memory of 1964 4624 svchost.com 2C935D~1.EXE PID 4624 wrote to memory of 1964 4624 svchost.com 2C935D~1.EXE PID 1964 wrote to memory of 4284 1964 2C935D~1.EXE svchost.com PID 1964 wrote to memory of 4284 1964 2C935D~1.EXE svchost.com PID 1964 wrote to memory of 4284 1964 2C935D~1.EXE svchost.com PID 4284 wrote to memory of 4388 4284 svchost.com 2C935D~1.EXE PID 4284 wrote to memory of 4388 4284 svchost.com 2C935D~1.EXE PID 4284 wrote to memory of 4388 4284 svchost.com 2C935D~1.EXE PID 4388 wrote to memory of 2556 4388 2C935D~1.EXE svchost.com PID 4388 wrote to memory of 2556 4388 2C935D~1.EXE svchost.com PID 4388 wrote to memory of 2556 4388 2C935D~1.EXE svchost.com PID 2556 wrote to memory of 3384 2556 svchost.com 2C935D~1.EXE PID 2556 wrote to memory of 3384 2556 svchost.com 2C935D~1.EXE PID 2556 wrote to memory of 3384 2556 svchost.com 2C935D~1.EXE PID 3384 wrote to memory of 4860 3384 2C935D~1.EXE svchost.com PID 3384 wrote to memory of 4860 3384 2C935D~1.EXE svchost.com PID 3384 wrote to memory of 4860 3384 2C935D~1.EXE svchost.com PID 4860 wrote to memory of 5084 4860 svchost.com 2C935D~1.EXE PID 4860 wrote to memory of 5084 4860 svchost.com 2C935D~1.EXE PID 4860 wrote to memory of 5084 4860 svchost.com 2C935D~1.EXE PID 5084 wrote to memory of 1228 5084 2C935D~1.EXE svchost.com PID 5084 wrote to memory of 1228 5084 2C935D~1.EXE svchost.com PID 5084 wrote to memory of 1228 5084 2C935D~1.EXE svchost.com PID 1228 wrote to memory of 1296 1228 svchost.com 2C935D~1.EXE PID 1228 wrote to memory of 1296 1228 svchost.com 2C935D~1.EXE PID 1228 wrote to memory of 1296 1228 svchost.com 2C935D~1.EXE PID 1296 wrote to memory of 2968 1296 2C935D~1.EXE svchost.com PID 1296 wrote to memory of 2968 1296 2C935D~1.EXE svchost.com PID 1296 wrote to memory of 2968 1296 2C935D~1.EXE svchost.com PID 2968 wrote to memory of 2296 2968 svchost.com 2C935D~1.EXE PID 2968 wrote to memory of 2296 2968 svchost.com 2C935D~1.EXE PID 2968 wrote to memory of 2296 2968 svchost.com 2C935D~1.EXE PID 2296 wrote to memory of 2904 2296 2C935D~1.EXE svchost.com PID 2296 wrote to memory of 2904 2296 2C935D~1.EXE svchost.com PID 2296 wrote to memory of 2904 2296 2C935D~1.EXE svchost.com PID 2904 wrote to memory of 2164 2904 svchost.com 2C935D~1.EXE PID 2904 wrote to memory of 2164 2904 svchost.com 2C935D~1.EXE PID 2904 wrote to memory of 2164 2904 svchost.com 2C935D~1.EXE PID 2164 wrote to memory of 4188 2164 2C935D~1.EXE svchost.com PID 2164 wrote to memory of 4188 2164 2C935D~1.EXE svchost.com PID 2164 wrote to memory of 4188 2164 2C935D~1.EXE svchost.com PID 4188 wrote to memory of 1460 4188 svchost.com 2C935D~1.EXE PID 4188 wrote to memory of 1460 4188 svchost.com 2C935D~1.EXE PID 4188 wrote to memory of 1460 4188 svchost.com 2C935D~1.EXE PID 1460 wrote to memory of 1180 1460 2C935D~1.EXE svchost.com PID 1460 wrote to memory of 1180 1460 2C935D~1.EXE svchost.com PID 1460 wrote to memory of 1180 1460 2C935D~1.EXE svchost.com PID 1180 wrote to memory of 176 1180 svchost.com 2C935D~1.EXE PID 1180 wrote to memory of 176 1180 svchost.com 2C935D~1.EXE PID 1180 wrote to memory of 176 1180 svchost.com 2C935D~1.EXE PID 176 wrote to memory of 1944 176 2C935D~1.EXE svchost.com PID 176 wrote to memory of 1944 176 2C935D~1.EXE svchost.com PID 176 wrote to memory of 1944 176 2C935D~1.EXE svchost.com PID 1944 wrote to memory of 4944 1944 svchost.com 2C935D~1.EXE PID 1944 wrote to memory of 4944 1944 svchost.com 2C935D~1.EXE PID 1944 wrote to memory of 4944 1944 svchost.com 2C935D~1.EXE PID 4944 wrote to memory of 3712 4944 2C935D~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe"C:\Users\Admin\AppData\Local\Temp\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe"1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE12⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE14⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE16⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:176 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"23⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE24⤵
- Executes dropped EXE
PID:3084 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"25⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE26⤵
- Executes dropped EXE
PID:3760 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"27⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE28⤵
- Executes dropped EXE
PID:4664 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"29⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE30⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Windows directory
PID:3916 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"31⤵
- Executes dropped EXE
PID:504 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE32⤵
- Executes dropped EXE
PID:4752 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"33⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE34⤵
- Executes dropped EXE
- Checks computer location settings
PID:4068 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"35⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE36⤵
- Executes dropped EXE
PID:612 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"37⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE38⤵
- Executes dropped EXE
PID:2456 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"39⤵
- Executes dropped EXE
PID:700 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE40⤵
- Executes dropped EXE
- Checks computer location settings
PID:2292 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"41⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE42⤵
- Executes dropped EXE
PID:4568 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"43⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE44⤵
- Executes dropped EXE
- Modifies registry class
PID:3068 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"45⤵
- Executes dropped EXE
PID:820 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE46⤵
- Executes dropped EXE
PID:64 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"47⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE48⤵
- Executes dropped EXE
PID:3628 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"49⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE50⤵
- Executes dropped EXE
PID:1268 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"51⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE52⤵
- Executes dropped EXE
- Modifies registry class
PID:2964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"53⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE54⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2576 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"55⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE56⤵
- Executes dropped EXE
PID:2556 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"57⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE58⤵
- Executes dropped EXE
PID:4848 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"59⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE60⤵
- Executes dropped EXE
PID:4496 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"61⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE62⤵
- Executes dropped EXE
- Checks computer location settings
PID:1416 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"63⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE64⤵
- Executes dropped EXE
PID:4016 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"65⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE66⤵
- Checks computer location settings
- Modifies registry class
PID:2132 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"67⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE68⤵PID:1968
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"69⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE70⤵PID:3512
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"71⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE72⤵PID:3704
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"73⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE74⤵
- Checks computer location settings
PID:3712 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"75⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE76⤵PID:3632
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"77⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE78⤵PID:4664
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"79⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE80⤵PID:1056
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"81⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE82⤵PID:3612
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"83⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE84⤵
- Modifies registry class
PID:2120 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"85⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE86⤵PID:4148
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"87⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE88⤵PID:952
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"89⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE90⤵
- Checks computer location settings
- Drops file in Windows directory
PID:2100 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"91⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE92⤵PID:4156
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"93⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE94⤵
- Drops file in Windows directory
PID:3972 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"95⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE96⤵PID:4708
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"97⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE98⤵
- Checks computer location settings
PID:1208 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"99⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE100⤵PID:4128
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"101⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE1⤵PID:4388
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"2⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE3⤵PID:4248
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"4⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE5⤵
- Checks computer location settings
PID:988 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"6⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE7⤵PID:4496
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"8⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE9⤵
- Checks computer location settings
PID:2584 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"10⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE11⤵
- Checks computer location settings
PID:3120 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"12⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE13⤵PID:2688
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"14⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE15⤵
- Checks computer location settings
- Drops file in Windows directory
PID:4252 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"16⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE17⤵PID:2804
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"18⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE19⤵
- Checks computer location settings
PID:1944 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"20⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE21⤵PID:3100
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"22⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE23⤵PID:3020
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"24⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE25⤵PID:1272
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"26⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE27⤵PID:624
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"28⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE29⤵PID:1672
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"30⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE31⤵PID:1732
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"32⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE33⤵PID:1128
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"34⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE35⤵PID:1040
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"36⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE37⤵PID:952
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"38⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE39⤵PID:4568
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"40⤵
- Drops file in Windows directory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE41⤵PID:3496
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"42⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE43⤵PID:3036
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"44⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE45⤵PID:4648
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"46⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE47⤵PID:3476
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"48⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE49⤵PID:3096
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"50⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE51⤵
- Modifies registry class
PID:1384 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"52⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE53⤵PID:4844
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"54⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE55⤵PID:1872
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"56⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE57⤵
- Modifies registry class
PID:1580 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"58⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE59⤵
- Checks computer location settings
PID:4688 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"60⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE61⤵
- Modifies registry class
PID:1976 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"62⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE63⤵PID:1180
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"64⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE65⤵
- Checks computer location settings
PID:1584 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"66⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE67⤵
- Drops file in Windows directory
PID:3536 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"68⤵
- Drops file in Windows directory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE69⤵
- Modifies registry class
PID:4444 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"70⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE71⤵
- Modifies registry class
PID:3720 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"72⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE73⤵PID:4600
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"74⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE75⤵PID:4024
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"76⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE77⤵
- Drops file in Windows directory
PID:3652 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"78⤵
- Drops file in Windows directory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE79⤵
- Checks computer location settings
PID:4664 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"80⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE81⤵
- Checks computer location settings
- Drops file in Windows directory
PID:1824 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"82⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE83⤵PID:612
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"84⤵
- Drops file in Windows directory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE85⤵PID:700
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"86⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE87⤵PID:2292
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"88⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE89⤵PID:3140
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"90⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE91⤵PID:4056
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"92⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE93⤵PID:1028
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"94⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE95⤵PID:4284
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"96⤵
- Drops file in Windows directory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE97⤵
- Drops file in Windows directory
PID:2768 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"98⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE99⤵PID:408
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"100⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE101⤵PID:4248
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"102⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE103⤵PID:988
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"104⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE105⤵PID:4496
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"106⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE107⤵PID:2584
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"108⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE109⤵
- Modifies registry class
PID:3120 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"110⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE111⤵PID:2688
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"112⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE113⤵
- Modifies registry class
PID:4252 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"114⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE115⤵PID:4060
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"116⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE117⤵PID:1936
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"118⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE119⤵
- Drops file in Windows directory
PID:4488 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"120⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE121⤵
- Modifies registry class
PID:3104 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"122⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE123⤵PID:4508
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"124⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE125⤵PID:4024
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"126⤵
- Drops file in Windows directory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE127⤵PID:1092
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"128⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE129⤵PID:1108
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"130⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE131⤵PID:1888
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"132⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE133⤵
- Modifies registry class
PID:4148 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"134⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE135⤵PID:4908
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"136⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE137⤵PID:4460
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"138⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE139⤵PID:3140
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"140⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE141⤵PID:3036
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"142⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE143⤵PID:3344
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"144⤵
- Drops file in Windows directory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE145⤵PID:3476
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"146⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE147⤵PID:1248
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"148⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE149⤵PID:1400
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"150⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE151⤵
- Modifies registry class
PID:2012 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"152⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE153⤵
- Checks computer location settings
PID:4348 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"154⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE155⤵PID:2164
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"156⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE157⤵PID:4828
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"158⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE159⤵PID:2360
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"160⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE161⤵PID:4724
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"162⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE163⤵
- Drops file in Windows directory
- Modifies registry class
PID:4864 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"164⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE165⤵PID:4628
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"166⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE167⤵PID:4768
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"168⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE169⤵PID:1956
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"170⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE171⤵PID:1848
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"172⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE173⤵PID:1508
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"174⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE175⤵
- Modifies registry class
PID:2668 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"176⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE177⤵PID:4456
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"178⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE179⤵PID:2456
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"180⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE181⤵
- Checks computer location settings
- Modifies registry class
PID:2936 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"182⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE183⤵PID:2964
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"184⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE185⤵PID:4048
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"186⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE187⤵PID:1028
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"188⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE189⤵PID:3344
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"190⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE191⤵
- Modifies registry class
PID:4388 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"192⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE193⤵PID:4248
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"194⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE195⤵PID:3388
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"196⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE197⤵PID:1680
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"198⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE199⤵PID:2296
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"200⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE201⤵PID:3120
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"202⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE203⤵
- Checks computer location settings
PID:2184 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"204⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE205⤵PID:3640
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"206⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE207⤵PID:112
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"208⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE209⤵
- Modifies registry class
PID:4740 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"210⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE211⤵PID:1412
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"212⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE213⤵
- Modifies registry class
PID:3428 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"214⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE215⤵PID:1932
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"216⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE217⤵PID:1860
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"218⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE219⤵PID:4664
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"220⤵
- Drops file in Windows directory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE221⤵PID:404
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"222⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE223⤵
- Modifies registry class
PID:2280 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"224⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE225⤵
- Modifies registry class
PID:4908 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"226⤵
- Drops file in Windows directory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE227⤵PID:3916
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"228⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE229⤵PID:1964
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"230⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE231⤵
- Checks computer location settings
PID:3400 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"232⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE233⤵PID:1076
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"234⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE235⤵
- Checks computer location settings
PID:2768 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"236⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE237⤵PID:4936
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"238⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE239⤵PID:1448
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"240⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE241⤵PID:2328
-