Analysis
-
max time kernel
99s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 14:17
Static task
static1
Behavioral task
behavioral1
Sample
bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe
Resource
win10v2004-20220414-en
General
-
Target
bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe
-
Size
2.9MB
-
MD5
db114448b5c2e2d2a45c04ef73d816c7
-
SHA1
22c950f7ef2a49c765d6bfe22cd131013c690d0d
-
SHA256
bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577
-
SHA512
f7ab283b58f5305947d5de3c9bfa435886772856513b5637dc4597746f01b0eb316fc4b1b4d34074b80d8808c8b606f4a7538d13fcf7c27ee64f23be2c108126
Malware Config
Signatures
-
Detect Neshta Payload 40 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\3582-490\bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe family_neshta C:\Windows\svchost.com family_neshta C:\odt\OFFICE~1.EXE family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe family_neshta C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE family_neshta C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE family_neshta C:\PROGRA~2\Google\Update\DISABL~1.EXE family_neshta C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE family_neshta C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE family_neshta C:\Windows\svchost.com family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exesvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.compid process 3216 bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe 4752 svchost.com 1604 BBD98F~1.EXE 4748 svchost.com 3236 BBD98F~1.EXE 1900 svchost.com 4644 BBD98F~1.EXE 32 svchost.com 100 BBD98F~1.EXE 2504 svchost.com 3372 BBD98F~1.EXE 3056 svchost.com 4352 BBD98F~1.EXE 3540 svchost.com 1496 BBD98F~1.EXE 3348 svchost.com 3452 BBD98F~1.EXE 856 svchost.com 992 BBD98F~1.EXE 5032 svchost.com 2376 BBD98F~1.EXE 4380 svchost.com 4556 BBD98F~1.EXE 1700 svchost.com 4176 BBD98F~1.EXE 60 svchost.com 4928 BBD98F~1.EXE 3744 svchost.com 3008 BBD98F~1.EXE 1172 svchost.com 4716 BBD98F~1.EXE 4024 svchost.com 4392 BBD98F~1.EXE 4108 svchost.com 1464 BBD98F~1.EXE 4948 svchost.com 4576 BBD98F~1.EXE 4684 svchost.com 4664 BBD98F~1.EXE 4592 svchost.com 3844 BBD98F~1.EXE 2400 svchost.com 4908 BBD98F~1.EXE 1508 svchost.com 5020 BBD98F~1.EXE 32 svchost.com 4672 BBD98F~1.EXE 4132 svchost.com 2592 BBD98F~1.EXE 3064 svchost.com 3800 BBD98F~1.EXE 1272 svchost.com 4352 BBD98F~1.EXE 4972 svchost.com 2040 BBD98F~1.EXE 4264 svchost.com 552 BBD98F~1.EXE 3452 svchost.com 3856 BBD98F~1.EXE 3332 svchost.com 1260 BBD98F~1.EXE 5052 svchost.com 5088 BBD98F~1.EXE 4852 svchost.com -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
BBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEbbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exeBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEsvchost.comsvchost.comdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BBD98F~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation svchost.com Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation svchost.com -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exebbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exedescription ioc process File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MI391D~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MI9C33~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13157~1.61\MICROS~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MICROS~3.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MIA062~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MICROS~2.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MICROS~4.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MI391D~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13157~1.61\MICROS~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe -
Drops file in Windows directory 64 IoCs
Processes:
BBD98F~1.EXEsvchost.comBBD98F~1.EXEBBD98F~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comsvchost.combbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exeBBD98F~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comBBD98F~1.EXEBBD98F~1.EXEsvchost.comBBD98F~1.EXEBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEBBD98F~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comBBD98F~1.EXEsvchost.comsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comsvchost.comBBD98F~1.EXEBBD98F~1.EXEsvchost.comBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEsvchost.comBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEsvchost.comdescription ioc process File opened for modification C:\Windows\directx.sys BBD98F~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys BBD98F~1.EXE File opened for modification C:\Windows\svchost.com BBD98F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com BBD98F~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com BBD98F~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe File opened for modification C:\Windows\directx.sys BBD98F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys BBD98F~1.EXE File opened for modification C:\Windows\directx.sys BBD98F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com BBD98F~1.EXE File opened for modification C:\Windows\directx.sys BBD98F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys BBD98F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys BBD98F~1.EXE File opened for modification C:\Windows\svchost.com BBD98F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys BBD98F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com BBD98F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys BBD98F~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys BBD98F~1.EXE File opened for modification C:\Windows\directx.sys BBD98F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com BBD98F~1.EXE File opened for modification C:\Windows\svchost.com BBD98F~1.EXE File opened for modification C:\Windows\directx.sys BBD98F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys BBD98F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com BBD98F~1.EXE File opened for modification C:\Windows\svchost.com BBD98F~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com BBD98F~1.EXE File opened for modification C:\Windows\svchost.com BBD98F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys BBD98F~1.EXE File opened for modification C:\Windows\directx.sys BBD98F~1.EXE File opened for modification C:\Windows\svchost.com BBD98F~1.EXE File opened for modification C:\Windows\directx.sys svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
Processes:
BBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEbbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exeBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEBBD98F~1.EXEbbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exeBBD98F~1.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings BBD98F~1.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
BBD98F~1.EXEpid process 2164 BBD98F~1.EXE 2164 BBD98F~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exebbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exesvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEsvchost.comBBD98F~1.EXEdescription pid process target process PID 4100 wrote to memory of 3216 4100 bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe PID 4100 wrote to memory of 3216 4100 bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe PID 4100 wrote to memory of 3216 4100 bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe PID 3216 wrote to memory of 4752 3216 bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe svchost.com PID 3216 wrote to memory of 4752 3216 bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe svchost.com PID 3216 wrote to memory of 4752 3216 bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe svchost.com PID 4752 wrote to memory of 1604 4752 svchost.com BBD98F~1.EXE PID 4752 wrote to memory of 1604 4752 svchost.com BBD98F~1.EXE PID 4752 wrote to memory of 1604 4752 svchost.com BBD98F~1.EXE PID 1604 wrote to memory of 4748 1604 BBD98F~1.EXE svchost.com PID 1604 wrote to memory of 4748 1604 BBD98F~1.EXE svchost.com PID 1604 wrote to memory of 4748 1604 BBD98F~1.EXE svchost.com PID 4748 wrote to memory of 3236 4748 svchost.com BBD98F~1.EXE PID 4748 wrote to memory of 3236 4748 svchost.com BBD98F~1.EXE PID 4748 wrote to memory of 3236 4748 svchost.com BBD98F~1.EXE PID 3236 wrote to memory of 1900 3236 BBD98F~1.EXE svchost.com PID 3236 wrote to memory of 1900 3236 BBD98F~1.EXE svchost.com PID 3236 wrote to memory of 1900 3236 BBD98F~1.EXE svchost.com PID 1900 wrote to memory of 4644 1900 svchost.com BBD98F~1.EXE PID 1900 wrote to memory of 4644 1900 svchost.com BBD98F~1.EXE PID 1900 wrote to memory of 4644 1900 svchost.com BBD98F~1.EXE PID 4644 wrote to memory of 32 4644 BBD98F~1.EXE svchost.com PID 4644 wrote to memory of 32 4644 BBD98F~1.EXE svchost.com PID 4644 wrote to memory of 32 4644 BBD98F~1.EXE svchost.com PID 32 wrote to memory of 100 32 svchost.com BBD98F~1.EXE PID 32 wrote to memory of 100 32 svchost.com BBD98F~1.EXE PID 32 wrote to memory of 100 32 svchost.com BBD98F~1.EXE PID 100 wrote to memory of 2504 100 BBD98F~1.EXE svchost.com PID 100 wrote to memory of 2504 100 BBD98F~1.EXE svchost.com PID 100 wrote to memory of 2504 100 BBD98F~1.EXE svchost.com PID 2504 wrote to memory of 3372 2504 svchost.com BBD98F~1.EXE PID 2504 wrote to memory of 3372 2504 svchost.com BBD98F~1.EXE PID 2504 wrote to memory of 3372 2504 svchost.com BBD98F~1.EXE PID 3372 wrote to memory of 3056 3372 BBD98F~1.EXE svchost.com PID 3372 wrote to memory of 3056 3372 BBD98F~1.EXE svchost.com PID 3372 wrote to memory of 3056 3372 BBD98F~1.EXE svchost.com PID 3056 wrote to memory of 4352 3056 svchost.com BBD98F~1.EXE PID 3056 wrote to memory of 4352 3056 svchost.com BBD98F~1.EXE PID 3056 wrote to memory of 4352 3056 svchost.com BBD98F~1.EXE PID 4352 wrote to memory of 3540 4352 BBD98F~1.EXE svchost.com PID 4352 wrote to memory of 3540 4352 BBD98F~1.EXE svchost.com PID 4352 wrote to memory of 3540 4352 BBD98F~1.EXE svchost.com PID 3540 wrote to memory of 1496 3540 svchost.com BBD98F~1.EXE PID 3540 wrote to memory of 1496 3540 svchost.com BBD98F~1.EXE PID 3540 wrote to memory of 1496 3540 svchost.com BBD98F~1.EXE PID 1496 wrote to memory of 3348 1496 BBD98F~1.EXE svchost.com PID 1496 wrote to memory of 3348 1496 BBD98F~1.EXE svchost.com PID 1496 wrote to memory of 3348 1496 BBD98F~1.EXE svchost.com PID 3348 wrote to memory of 3452 3348 svchost.com BBD98F~1.EXE PID 3348 wrote to memory of 3452 3348 svchost.com BBD98F~1.EXE PID 3348 wrote to memory of 3452 3348 svchost.com BBD98F~1.EXE PID 3452 wrote to memory of 856 3452 BBD98F~1.EXE svchost.com PID 3452 wrote to memory of 856 3452 BBD98F~1.EXE svchost.com PID 3452 wrote to memory of 856 3452 BBD98F~1.EXE svchost.com PID 856 wrote to memory of 992 856 svchost.com BBD98F~1.EXE PID 856 wrote to memory of 992 856 svchost.com BBD98F~1.EXE PID 856 wrote to memory of 992 856 svchost.com BBD98F~1.EXE PID 992 wrote to memory of 5032 992 BBD98F~1.EXE svchost.com PID 992 wrote to memory of 5032 992 BBD98F~1.EXE svchost.com PID 992 wrote to memory of 5032 992 BBD98F~1.EXE svchost.com PID 5032 wrote to memory of 2376 5032 svchost.com BBD98F~1.EXE PID 5032 wrote to memory of 2376 5032 svchost.com BBD98F~1.EXE PID 5032 wrote to memory of 2376 5032 svchost.com BBD98F~1.EXE PID 2376 wrote to memory of 4380 2376 BBD98F~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe"C:\Users\Admin\AppData\Local\Temp\bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe"1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\3582-490\bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\bbd98f0e73ed759a737d725d8a4a368579cac7303d0aca460274762156743577.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE6⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE12⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE14⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE16⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE18⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE20⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE22⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"23⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE24⤵
- Executes dropped EXE
PID:4556 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"25⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE26⤵
- Executes dropped EXE
PID:4176 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"27⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE28⤵
- Executes dropped EXE
PID:4928 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"29⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE30⤵
- Executes dropped EXE
PID:3008 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"31⤵
- Executes dropped EXE
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE32⤵
- Executes dropped EXE
- Checks computer location settings
PID:4716 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"33⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE34⤵
- Executes dropped EXE
PID:4392 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"35⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE36⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
PID:1464 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"37⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE38⤵
- Executes dropped EXE
- Checks computer location settings
PID:4576 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"39⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE40⤵
- Executes dropped EXE
PID:4664 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"41⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE42⤵
- Executes dropped EXE
- Checks computer location settings
PID:3844 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"43⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE44⤵
- Executes dropped EXE
- Checks computer location settings
PID:4908 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"45⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE46⤵
- Executes dropped EXE
- Modifies registry class
PID:5020 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"47⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:32 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE48⤵
- Executes dropped EXE
PID:4672 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"49⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE50⤵
- Executes dropped EXE
PID:2592 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"51⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE52⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
PID:3800 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"53⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE54⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Windows directory
PID:4352 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"55⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE56⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Windows directory
PID:2040 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"57⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE58⤵
- Executes dropped EXE
- Modifies registry class
PID:552 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"59⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE60⤵
- Executes dropped EXE
- Checks computer location settings
PID:3856 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"61⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE62⤵
- Executes dropped EXE
- Modifies registry class
PID:1260 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"63⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE64⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
PID:5088 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"65⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE66⤵
- Checks computer location settings
- Modifies registry class
PID:3828 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"67⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE68⤵PID:1832
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"69⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE70⤵PID:3444
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"71⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE72⤵PID:1624
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"73⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE74⤵PID:4188
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"75⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE76⤵PID:1092
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"77⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE78⤵
- Checks computer location settings
- Modifies registry class
PID:1280 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"79⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE80⤵PID:3228
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"81⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE82⤵
- Checks computer location settings
- Modifies registry class
PID:4780 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"83⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE84⤵
- Modifies registry class
PID:3960 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"85⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE86⤵PID:1188
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"87⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE88⤵PID:1900
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"89⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE90⤵PID:112
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"91⤵PID:32
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE92⤵PID:2408
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"93⤵
- Drops file in Windows directory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE94⤵
- Modifies registry class
PID:4832 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"95⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE96⤵PID:3064
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"97⤵
- Drops file in Windows directory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE98⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
PID:3508 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"99⤵
- Drops file in Windows directory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE100⤵PID:4352
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"101⤵
- Drops file in Windows directory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE102⤵
- Checks computer location settings
- Modifies registry class
PID:3560 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"103⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE104⤵
- Checks computer location settings
PID:1396 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"105⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE106⤵
- Modifies registry class
PID:2268 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"107⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE108⤵
- Modifies registry class
PID:2976 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"109⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE110⤵
- Checks computer location settings
PID:440 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"111⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE112⤵
- Checks computer location settings
- Modifies registry class
PID:4852 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"113⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE114⤵
- Checks computer location settings
PID:3152 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"115⤵
- Drops file in Windows directory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE116⤵
- Checks computer location settings
PID:1820 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"117⤵
- Drops file in Windows directory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE118⤵
- Drops file in Windows directory
- Modifies registry class
PID:360 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"119⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE120⤵
- Checks computer location settings
PID:1952 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"121⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE122⤵
- Checks computer location settings
PID:1092 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"123⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE124⤵
- Drops file in Windows directory
- Modifies registry class
PID:4108 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"125⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE126⤵PID:2596
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"127⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE128⤵
- Drops file in Windows directory
- Modifies registry class
PID:3404 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"129⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE130⤵PID:976
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"131⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE132⤵
- Modifies registry class
PID:2892 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"133⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE134⤵PID:2400
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"135⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE136⤵PID:2060
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"137⤵
- Checks computer location settings
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE138⤵
- Checks computer location settings
PID:4500 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"139⤵
- Checks computer location settings
- Drops file in Windows directory
PID:112 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE140⤵
- Drops file in Windows directory
- Modifies registry class
PID:1268 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"141⤵
- Drops file in Windows directory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE142⤵
- Checks computer location settings
- Drops file in Windows directory
PID:2408 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"143⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE144⤵PID:4112
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"145⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE146⤵
- Checks computer location settings
PID:3800 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"147⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE148⤵
- Drops file in Windows directory
- Modifies registry class
PID:4984 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"149⤵
- Drops file in Windows directory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE150⤵PID:4352
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"151⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE152⤵
- Checks computer location settings
- Modifies registry class
PID:3560 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"153⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE154⤵PID:4284
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"155⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE156⤵
- Modifies registry class
PID:444 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"157⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE158⤵
- Drops file in Windows directory
PID:5052 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"159⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE160⤵
- Checks computer location settings
PID:2824 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"161⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE162⤵
- Modifies registry class
PID:1712 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"163⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE164⤵
- Checks computer location settings
- Drops file in Windows directory
PID:4572 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"165⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE166⤵PID:3444
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"167⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE168⤵PID:396
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"169⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE170⤵
- Drops file in Windows directory
PID:1984 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"171⤵
- Drops file in Windows directory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE172⤵PID:4032
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"173⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE174⤵
- Modifies registry class
PID:1464 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"175⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE176⤵
- Drops file in Windows directory
PID:1296 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"177⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE178⤵
- Checks computer location settings
- Modifies registry class
PID:2596 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"179⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE180⤵PID:2676
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"181⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE182⤵
- Checks computer location settings
- Modifies registry class
PID:4600 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"183⤵
- Drops file in Windows directory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE184⤵
- Checks computer location settings
- Modifies registry class
PID:4712 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"185⤵
- Drops file in Windows directory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE186⤵PID:1508
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"187⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE188⤵PID:4808
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"189⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE190⤵PID:2372
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"191⤵
- Drops file in Windows directory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE192⤵PID:908
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"193⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE194⤵PID:4372
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"195⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE196⤵
- Modifies registry class
PID:3496 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"197⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE198⤵
- Modifies registry class
PID:4972 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"199⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE200⤵
- Checks computer location settings
PID:2848 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"201⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE202⤵
- Drops file in Windows directory
PID:3040 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"203⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE204⤵
- Drops file in Windows directory
- Modifies registry class
PID:4020 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"205⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE206⤵PID:3360
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"207⤵
- Drops file in Windows directory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE208⤵
- Checks computer location settings
PID:5084 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"209⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE210⤵
- Modifies registry class
PID:3544 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"211⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE212⤵
- Drops file in Windows directory
- Modifies registry class
PID:884 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"213⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE214⤵
- Drops file in Windows directory
PID:2036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"215⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE216⤵
- Checks computer location settings
- Modifies registry class
PID:2668 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"217⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE218⤵
- Checks computer location settings
PID:3008 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"219⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE220⤵
- Checks computer location settings
PID:4420 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"221⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE222⤵
- Checks computer location settings
PID:3164 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"223⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE224⤵PID:4000
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"225⤵
- Drops file in Windows directory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE226⤵
- Drops file in Windows directory
- Modifies registry class
PID:3984 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"227⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE228⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
PID:5036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"229⤵
- Drops file in Windows directory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE230⤵
- Modifies registry class
PID:2252 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"231⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE232⤵
- Checks computer location settings
PID:976 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"233⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE234⤵PID:4752
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"235⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE236⤵
- Checks computer location settings
PID:2400 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"237⤵
- Drops file in Windows directory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE238⤵
- Drops file in Windows directory
PID:2672 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"239⤵
- Drops file in Windows directory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE240⤵
- Checks computer location settings
- Modifies registry class
PID:2656 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BBD98F~1.EXE"241⤵PID:4520
-