Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
22-02-2022 08:15
Static task
static1
Behavioral task
behavioral1
Sample
2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe
Resource
win10v2004-en-20220113
General
-
Target
2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe
-
Size
168KB
-
MD5
c0cda789e54e55adb82254b49ee6459c
-
SHA1
03117a0e347e5a4ebdbca24560777871e003eed4
-
SHA256
2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8
-
SHA512
6bcc733d0d41599537842a741ef8411cf40a9c7a13ed50302bfcbf37c82f29fdc4d07b10d168d497f0e55820a9a193cce28dc30749e38f37ee320e2a15ab76f4
Malware Config
Signatures
-
Detect Neshta Payload 47 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE family_neshta C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Nirsoft 32 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft \Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe Nirsoft -
Executes dropped EXE 64 IoCs
Processes:
2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exesvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.compid process 1124 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe 760 svchost.com 360 2C769C~1.EXE 1060 svchost.com 1428 2C769C~1.EXE 1928 svchost.com 1804 2C769C~1.EXE 1528 svchost.com 1888 2C769C~1.EXE 1312 svchost.com 1456 2C769C~1.EXE 1076 svchost.com 1752 2C769C~1.EXE 1088 svchost.com 684 2C769C~1.EXE 608 svchost.com 1452 2C769C~1.EXE 1564 svchost.com 700 2C769C~1.EXE 668 svchost.com 824 2C769C~1.EXE 1568 svchost.com 724 2C769C~1.EXE 1100 svchost.com 1908 2C769C~1.EXE 1444 svchost.com 1536 2C769C~1.EXE 1400 svchost.com 1512 2C769C~1.EXE 1492 svchost.com 1544 2C769C~1.EXE 976 svchost.com 1180 2C769C~1.EXE 1904 svchost.com 1456 2C769C~1.EXE 1884 svchost.com 2008 2C769C~1.EXE 1696 svchost.com 920 2C769C~1.EXE 884 svchost.com 1896 2C769C~1.EXE 1720 svchost.com 1592 2C769C~1.EXE 1612 svchost.com 524 2C769C~1.EXE 1792 svchost.com 1564 2C769C~1.EXE 788 svchost.com 1756 2C769C~1.EXE 824 svchost.com 1876 2C769C~1.EXE 440 svchost.com 1056 2C769C~1.EXE 1908 svchost.com 1000 2C769C~1.EXE 1536 svchost.com 1552 2C769C~1.EXE 1296 svchost.com 856 2C769C~1.EXE 1744 svchost.com 1748 2C769C~1.EXE 1312 svchost.com 708 2C769C~1.EXE 1064 svchost.com -
Loads dropped DLL 64 IoCs
Processes:
2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.compid process 956 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe 956 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe 760 svchost.com 760 svchost.com 1060 svchost.com 1060 svchost.com 1928 svchost.com 1928 svchost.com 1528 svchost.com 1528 svchost.com 1312 svchost.com 1312 svchost.com 1076 svchost.com 1076 svchost.com 1088 svchost.com 1088 svchost.com 608 svchost.com 608 svchost.com 1564 svchost.com 1564 svchost.com 668 svchost.com 668 svchost.com 1568 svchost.com 1568 svchost.com 1100 svchost.com 1100 svchost.com 1444 svchost.com 1444 svchost.com 956 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe 1124 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe 1400 svchost.com 1400 svchost.com 1492 svchost.com 1492 svchost.com 976 svchost.com 976 svchost.com 1904 svchost.com 1904 svchost.com 1884 svchost.com 1884 svchost.com 1696 svchost.com 1696 svchost.com 884 svchost.com 884 svchost.com 1720 svchost.com 1720 svchost.com 1612 svchost.com 1612 svchost.com 1792 svchost.com 1792 svchost.com 788 svchost.com 788 svchost.com 824 svchost.com 824 svchost.com 440 svchost.com 440 svchost.com 1908 svchost.com 1908 svchost.com 1536 svchost.com 1536 svchost.com 1296 svchost.com 1296 svchost.com 1744 svchost.com 1744 svchost.com -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exedescription ioc process File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe -
Drops file in Windows directory 64 IoCs
Processes:
2C769C~1.EXEsvchost.comsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.comsvchost.comsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXE2C769C~1.EXE2C769C~1.EXEsvchost.comsvchost.com2C769C~1.EXE2C769C~1.EXE2C769C~1.EXE2C769C~1.EXE2C769C~1.EXE2C769C~1.EXEsvchost.comsvchost.com2C769C~1.EXE2C769C~1.EXE2C769C~1.EXE2C769C~1.EXEsvchost.comsvchost.comsvchost.com2C769C~1.EXEdescription ioc process File opened for modification C:\Windows\svchost.com 2C769C~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com 2C769C~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 2C769C~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2C769C~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2C769C~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2C769C~1.EXE File opened for modification C:\Windows\directx.sys 2C769C~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys 2C769C~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2C769C~1.EXE File opened for modification C:\Windows\svchost.com 2C769C~1.EXE File opened for modification C:\Windows\svchost.com 2C769C~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com 2C769C~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com 2C769C~1.EXE File opened for modification C:\Windows\directx.sys 2C769C~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2C769C~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com 2C769C~1.EXE File opened for modification C:\Windows\svchost.com 2C769C~1.EXE File opened for modification C:\Windows\svchost.com 2C769C~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2C769C~1.EXE File opened for modification C:\Windows\directx.sys 2C769C~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
pid process 1576 1576 1576 1576 1576 1576 1576 1576 1576 1576 1576 1576 1576 1576 1576 1576 1576 1576 1576 1576 1576 1576 1576 1576 1576 1576 1576 1576 1576 1576 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
description pid process Token: SeDebugPrivilege 1576 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exesvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEsvchost.com2C769C~1.EXEdescription pid process target process PID 956 wrote to memory of 1124 956 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe PID 956 wrote to memory of 1124 956 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe PID 956 wrote to memory of 1124 956 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe PID 956 wrote to memory of 1124 956 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe PID 1124 wrote to memory of 760 1124 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe svchost.com PID 1124 wrote to memory of 760 1124 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe svchost.com PID 1124 wrote to memory of 760 1124 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe svchost.com PID 1124 wrote to memory of 760 1124 2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe svchost.com PID 760 wrote to memory of 360 760 svchost.com 2C769C~1.EXE PID 760 wrote to memory of 360 760 svchost.com 2C769C~1.EXE PID 760 wrote to memory of 360 760 svchost.com 2C769C~1.EXE PID 760 wrote to memory of 360 760 svchost.com 2C769C~1.EXE PID 360 wrote to memory of 1060 360 2C769C~1.EXE svchost.com PID 360 wrote to memory of 1060 360 2C769C~1.EXE svchost.com PID 360 wrote to memory of 1060 360 2C769C~1.EXE svchost.com PID 360 wrote to memory of 1060 360 2C769C~1.EXE svchost.com PID 1060 wrote to memory of 1428 1060 svchost.com 2C769C~1.EXE PID 1060 wrote to memory of 1428 1060 svchost.com 2C769C~1.EXE PID 1060 wrote to memory of 1428 1060 svchost.com 2C769C~1.EXE PID 1060 wrote to memory of 1428 1060 svchost.com 2C769C~1.EXE PID 1428 wrote to memory of 1928 1428 2C769C~1.EXE svchost.com PID 1428 wrote to memory of 1928 1428 2C769C~1.EXE svchost.com PID 1428 wrote to memory of 1928 1428 2C769C~1.EXE svchost.com PID 1428 wrote to memory of 1928 1428 2C769C~1.EXE svchost.com PID 1928 wrote to memory of 1804 1928 svchost.com 2C769C~1.EXE PID 1928 wrote to memory of 1804 1928 svchost.com 2C769C~1.EXE PID 1928 wrote to memory of 1804 1928 svchost.com 2C769C~1.EXE PID 1928 wrote to memory of 1804 1928 svchost.com 2C769C~1.EXE PID 1804 wrote to memory of 1528 1804 2C769C~1.EXE svchost.com PID 1804 wrote to memory of 1528 1804 2C769C~1.EXE svchost.com PID 1804 wrote to memory of 1528 1804 2C769C~1.EXE svchost.com PID 1804 wrote to memory of 1528 1804 2C769C~1.EXE svchost.com PID 1528 wrote to memory of 1888 1528 svchost.com 2C769C~1.EXE PID 1528 wrote to memory of 1888 1528 svchost.com 2C769C~1.EXE PID 1528 wrote to memory of 1888 1528 svchost.com 2C769C~1.EXE PID 1528 wrote to memory of 1888 1528 svchost.com 2C769C~1.EXE PID 1888 wrote to memory of 1312 1888 2C769C~1.EXE svchost.com PID 1888 wrote to memory of 1312 1888 2C769C~1.EXE svchost.com PID 1888 wrote to memory of 1312 1888 2C769C~1.EXE svchost.com PID 1888 wrote to memory of 1312 1888 2C769C~1.EXE svchost.com PID 1312 wrote to memory of 1456 1312 svchost.com 2C769C~1.EXE PID 1312 wrote to memory of 1456 1312 svchost.com 2C769C~1.EXE PID 1312 wrote to memory of 1456 1312 svchost.com 2C769C~1.EXE PID 1312 wrote to memory of 1456 1312 svchost.com 2C769C~1.EXE PID 1456 wrote to memory of 1076 1456 2C769C~1.EXE svchost.com PID 1456 wrote to memory of 1076 1456 2C769C~1.EXE svchost.com PID 1456 wrote to memory of 1076 1456 2C769C~1.EXE svchost.com PID 1456 wrote to memory of 1076 1456 2C769C~1.EXE svchost.com PID 1076 wrote to memory of 1752 1076 svchost.com 2C769C~1.EXE PID 1076 wrote to memory of 1752 1076 svchost.com 2C769C~1.EXE PID 1076 wrote to memory of 1752 1076 svchost.com 2C769C~1.EXE PID 1076 wrote to memory of 1752 1076 svchost.com 2C769C~1.EXE PID 1752 wrote to memory of 1088 1752 2C769C~1.EXE svchost.com PID 1752 wrote to memory of 1088 1752 2C769C~1.EXE svchost.com PID 1752 wrote to memory of 1088 1752 2C769C~1.EXE svchost.com PID 1752 wrote to memory of 1088 1752 2C769C~1.EXE svchost.com PID 1088 wrote to memory of 684 1088 svchost.com 2C769C~1.EXE PID 1088 wrote to memory of 684 1088 svchost.com 2C769C~1.EXE PID 1088 wrote to memory of 684 1088 svchost.com 2C769C~1.EXE PID 1088 wrote to memory of 684 1088 svchost.com 2C769C~1.EXE PID 684 wrote to memory of 608 684 2C769C~1.EXE svchost.com PID 684 wrote to memory of 608 684 2C769C~1.EXE svchost.com PID 684 wrote to memory of 608 684 2C769C~1.EXE svchost.com PID 684 wrote to memory of 608 684 2C769C~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe"C:\Users\Admin\AppData\Local\Temp\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\2c769cab7d5098a52060d096cf228eea4a23b85ae3c6717792f8dcf0cef471a8.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:608 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE18⤵
- Executes dropped EXE
PID:1452 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE20⤵
- Executes dropped EXE
PID:700 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:668 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE22⤵
- Executes dropped EXE
PID:824 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE24⤵
- Executes dropped EXE
PID:724 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE26⤵
- Executes dropped EXE
PID:1908 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE28⤵
- Executes dropped EXE
PID:1536 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE30⤵
- Executes dropped EXE
PID:1512 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE32⤵
- Executes dropped EXE
PID:1544 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:976 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE34⤵
- Executes dropped EXE
PID:1180 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE36⤵
- Executes dropped EXE
PID:1456 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE38⤵
- Executes dropped EXE
PID:2008 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE40⤵
- Executes dropped EXE
PID:920 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE42⤵
- Executes dropped EXE
PID:1896 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE44⤵
- Executes dropped EXE
PID:1592 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE46⤵
- Executes dropped EXE
PID:524 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE48⤵
- Executes dropped EXE
PID:1564 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE50⤵
- Executes dropped EXE
PID:1756 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:824 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE52⤵
- Executes dropped EXE
PID:1876 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:440 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE54⤵
- Executes dropped EXE
PID:1056 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE56⤵
- Executes dropped EXE
PID:1000 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE58⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1552 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE60⤵
- Executes dropped EXE
PID:856 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE62⤵
- Executes dropped EXE
PID:1748 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"63⤵
- Executes dropped EXE
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE64⤵
- Executes dropped EXE
PID:708 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"65⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE66⤵PID:880
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"67⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE68⤵PID:1684
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"69⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE70⤵PID:968
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"71⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE72⤵PID:1368
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"73⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE74⤵PID:1072
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"75⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE76⤵PID:1672
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"77⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE78⤵PID:760
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"79⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE80⤵PID:1428
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"81⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE82⤵PID:1788
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"83⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE84⤵PID:1928
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"85⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE86⤵PID:1400
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"87⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE88⤵PID:1528
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"89⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE90⤵PID:1716
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"91⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE92⤵PID:1636
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"93⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE94⤵PID:1884
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"95⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE96⤵PID:1696
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"97⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE98⤵
- Drops file in Windows directory
PID:1088 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"99⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE100⤵PID:608
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"101⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE102⤵PID:528
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"103⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE104⤵PID:1792
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"105⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE106⤵PID:1756
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"107⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE108⤵PID:672
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"109⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE110⤵PID:1060
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"111⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE112⤵PID:1436
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"113⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE114⤵PID:1888
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"115⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE116⤵PID:1200
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"117⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE118⤵PID:976
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"119⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE120⤵PID:1748
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"121⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE122⤵
- Drops file in Windows directory
PID:880 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"123⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE124⤵PID:1168
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"125⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE126⤵PID:1712
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"127⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE128⤵PID:1464
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"129⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE130⤵PID:1500
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"131⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE132⤵PID:700
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"133⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE134⤵PID:1912
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"135⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE136⤵PID:1876
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"137⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE138⤵PID:1648
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"139⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE140⤵PID:1908
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"141⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE142⤵PID:1520
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"143⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE144⤵PID:736
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"145⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE146⤵PID:240
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"147⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE148⤵PID:572
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"149⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE150⤵PID:1196
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"151⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE152⤵PID:1728
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"153⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE154⤵PID:1376
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"155⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE156⤵PID:1592
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"157⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE158⤵PID:1464
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"159⤵PID:360
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE160⤵PID:1872
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"161⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE162⤵PID:588
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"163⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE164⤵
- Drops file in Windows directory
PID:2024 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"165⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE166⤵PID:1820
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"167⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE168⤵PID:1100
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"169⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE170⤵PID:1864
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"171⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE172⤵PID:1512
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"173⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE174⤵PID:988
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"175⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE176⤵PID:240
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"177⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE178⤵PID:1984
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"179⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE180⤵PID:1012
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"181⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE182⤵PID:1584
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"183⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE184⤵PID:1588
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"185⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE186⤵PID:1948
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"187⤵
- Drops file in Windows directory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE188⤵PID:1780
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"189⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE190⤵PID:1016
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"191⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE192⤵PID:672
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"193⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE194⤵PID:1428
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"195⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE196⤵PID:1524
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"197⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE198⤵PID:1956
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"199⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE200⤵PID:856
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"201⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE202⤵PID:1200
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"203⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE204⤵PID:1892
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"205⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE206⤵PID:1748
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"207⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE208⤵PID:1696
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"209⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE210⤵PID:1684
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"211⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE212⤵PID:1208
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"213⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE214⤵PID:1096
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"215⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE216⤵PID:652
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"217⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE218⤵PID:1672
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"219⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE220⤵PID:916
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"221⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE222⤵PID:1820
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"223⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE224⤵PID:1000
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"225⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE226⤵PID:1964
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"227⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE228⤵PID:1472
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"229⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE230⤵PID:1824
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"231⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE232⤵PID:240
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"233⤵
- Drops file in Windows directory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE234⤵PID:1904
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"235⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE236⤵PID:1196
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"237⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE238⤵PID:1728
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"239⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE240⤵PID:1376
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C769C~1.EXE"241⤵PID:1204
-