Analysis
-
max time kernel
172s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 08:03
Static task
static1
Behavioral task
behavioral1
Sample
563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe
Resource
win10v2004-20220812-en
General
-
Target
563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe
-
Size
449KB
-
MD5
0adbb86dccea903eba1d5c95f509dba0
-
SHA1
6f51448ff3ac90602cbfacd38a6fb41d72e77a04
-
SHA256
563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45
-
SHA512
1d20f116d80461154db7d4dd6f296ecd31bb72a8072c2b8d5645c798c80c610798c9fa8649f43aa7586f23cb63ae0fe8195222b4f5503c6ec21eaa6cac199fa1
-
SSDEEP
12288:anZ25m3ERLRoveIP91TDKkg30XZcqePSKQan:S25m3ERRovn95DKkg3SZx5KQan
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exesvchost.exe563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exesvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.exesvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEpid process 892 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe 672 svchost.exe 588 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe 872 svchost.com 900 563DAC~1.EXE 1972 svchost.com 976 563DAC~1.EXE 1752 svchost.com 300 563DAC~1.EXE 1924 svchost.exe 1508 svchost.com 1460 563DAC~1.EXE 1636 svchost.com 1816 563DAC~1.EXE 1368 svchost.com 2044 563DAC~1.EXE 592 svchost.com 1648 563DAC~1.EXE 1788 svchost.com 1536 563DAC~1.EXE 1672 svchost.com 304 563DAC~1.EXE 308 svchost.com 316 563DAC~1.EXE 1544 svchost.com 1164 563DAC~1.EXE 1520 svchost.com 464 563DAC~1.EXE 1704 svchost.com 1684 563DAC~1.EXE 1980 svchost.com 932 563DAC~1.EXE 1868 svchost.com 1932 563DAC~1.EXE 756 svchost.com 1800 563DAC~1.EXE 2024 svchost.com 1552 563DAC~1.EXE 892 svchost.com 1532 563DAC~1.EXE 520 svchost.com 1476 563DAC~1.EXE 1400 svchost.com 540 563DAC~1.EXE 872 svchost.com 912 563DAC~1.EXE 868 svchost.com 1992 563DAC~1.EXE 308 svchost.com 316 563DAC~1.EXE 1512 svchost.com 1200 563DAC~1.EXE 1520 svchost.com 1996 563DAC~1.EXE 296 svchost.com 1632 563DAC~1.EXE 1744 svchost.com 1836 563DAC~1.EXE 1868 svchost.com 1404 563DAC~1.EXE 1456 svchost.com 1480 563DAC~1.EXE 2024 svchost.com 636 563DAC~1.EXE -
Loads dropped DLL 64 IoCs
Processes:
563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exesvchost.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.compid process 1472 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe 1472 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe 672 svchost.exe 672 svchost.exe 872 svchost.com 872 svchost.com 1972 svchost.com 1972 svchost.com 1752 svchost.com 1752 svchost.com 1508 svchost.com 1508 svchost.com 1636 svchost.com 1636 svchost.com 1368 svchost.com 1368 svchost.com 592 svchost.com 592 svchost.com 1788 svchost.com 1788 svchost.com 1672 svchost.com 1672 svchost.com 308 svchost.com 308 svchost.com 1544 svchost.com 1544 svchost.com 1520 svchost.com 1520 svchost.com 1704 svchost.com 1704 svchost.com 1980 svchost.com 1980 svchost.com 1868 svchost.com 1868 svchost.com 756 svchost.com 756 svchost.com 1472 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe 588 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe 2024 svchost.com 2024 svchost.com 892 svchost.com 892 svchost.com 520 svchost.com 520 svchost.com 1400 svchost.com 1400 svchost.com 872 svchost.com 872 svchost.com 868 svchost.com 868 svchost.com 308 svchost.com 308 svchost.com 1512 svchost.com 1512 svchost.com 1520 svchost.com 1520 svchost.com 296 svchost.com 296 svchost.com 1744 svchost.com 1744 svchost.com 1868 svchost.com 1868 svchost.com 1456 svchost.com 1456 svchost.com -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exedescription ioc process File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe -
Drops file in Windows directory 64 IoCs
Processes:
svchost.comsvchost.com563DAC~1.EXE563DAC~1.EXE563DAC~1.EXE563DAC~1.EXEsvchost.comsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXE563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXE563DAC~1.EXE563DAC~1.EXEsvchost.comsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXE563DAC~1.EXE563DAC~1.EXEsvchost.comsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEdescription ioc process File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys 563DAC~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys 563DAC~1.EXE File opened for modification C:\Windows\svchost.com 563DAC~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys 563DAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com 563DAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 563DAC~1.EXE File opened for modification C:\Windows\directx.sys 563DAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 563DAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 563DAC~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com 563DAC~1.EXE File opened for modification C:\Windows\svchost.com 563DAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 563DAC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys 563DAC~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com 563DAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 563DAC~1.EXE File opened for modification C:\Windows\directx.sys 563DAC~1.EXE File opened for modification C:\Windows\directx.sys 563DAC~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 563DAC~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com 563DAC~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exesvchost.exe563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exesvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEsvchost.com563DAC~1.EXEdescription pid process target process PID 1472 wrote to memory of 892 1472 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe PID 1472 wrote to memory of 892 1472 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe PID 1472 wrote to memory of 892 1472 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe PID 1472 wrote to memory of 892 1472 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe PID 892 wrote to memory of 672 892 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe svchost.exe PID 892 wrote to memory of 672 892 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe svchost.exe PID 892 wrote to memory of 672 892 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe svchost.exe PID 892 wrote to memory of 672 892 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe svchost.exe PID 672 wrote to memory of 588 672 svchost.exe 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe PID 672 wrote to memory of 588 672 svchost.exe 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe PID 672 wrote to memory of 588 672 svchost.exe 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe PID 672 wrote to memory of 588 672 svchost.exe 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe PID 588 wrote to memory of 872 588 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe svchost.com PID 588 wrote to memory of 872 588 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe svchost.com PID 588 wrote to memory of 872 588 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe svchost.com PID 588 wrote to memory of 872 588 563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe svchost.com PID 872 wrote to memory of 900 872 svchost.com 563DAC~1.EXE PID 872 wrote to memory of 900 872 svchost.com 563DAC~1.EXE PID 872 wrote to memory of 900 872 svchost.com 563DAC~1.EXE PID 872 wrote to memory of 900 872 svchost.com 563DAC~1.EXE PID 900 wrote to memory of 1972 900 563DAC~1.EXE svchost.com PID 900 wrote to memory of 1972 900 563DAC~1.EXE svchost.com PID 900 wrote to memory of 1972 900 563DAC~1.EXE svchost.com PID 900 wrote to memory of 1972 900 563DAC~1.EXE svchost.com PID 1972 wrote to memory of 976 1972 svchost.com 563DAC~1.EXE PID 1972 wrote to memory of 976 1972 svchost.com 563DAC~1.EXE PID 1972 wrote to memory of 976 1972 svchost.com 563DAC~1.EXE PID 1972 wrote to memory of 976 1972 svchost.com 563DAC~1.EXE PID 976 wrote to memory of 1752 976 563DAC~1.EXE svchost.com PID 976 wrote to memory of 1752 976 563DAC~1.EXE svchost.com PID 976 wrote to memory of 1752 976 563DAC~1.EXE svchost.com PID 976 wrote to memory of 1752 976 563DAC~1.EXE svchost.com PID 1752 wrote to memory of 300 1752 svchost.com 563DAC~1.EXE PID 1752 wrote to memory of 300 1752 svchost.com 563DAC~1.EXE PID 1752 wrote to memory of 300 1752 svchost.com 563DAC~1.EXE PID 1752 wrote to memory of 300 1752 svchost.com 563DAC~1.EXE PID 300 wrote to memory of 1508 300 563DAC~1.EXE svchost.com PID 300 wrote to memory of 1508 300 563DAC~1.EXE svchost.com PID 300 wrote to memory of 1508 300 563DAC~1.EXE svchost.com PID 300 wrote to memory of 1508 300 563DAC~1.EXE svchost.com PID 1508 wrote to memory of 1460 1508 svchost.com 563DAC~1.EXE PID 1508 wrote to memory of 1460 1508 svchost.com 563DAC~1.EXE PID 1508 wrote to memory of 1460 1508 svchost.com 563DAC~1.EXE PID 1508 wrote to memory of 1460 1508 svchost.com 563DAC~1.EXE PID 1460 wrote to memory of 1636 1460 563DAC~1.EXE svchost.com PID 1460 wrote to memory of 1636 1460 563DAC~1.EXE svchost.com PID 1460 wrote to memory of 1636 1460 563DAC~1.EXE svchost.com PID 1460 wrote to memory of 1636 1460 563DAC~1.EXE svchost.com PID 1636 wrote to memory of 1816 1636 svchost.com 563DAC~1.EXE PID 1636 wrote to memory of 1816 1636 svchost.com 563DAC~1.EXE PID 1636 wrote to memory of 1816 1636 svchost.com 563DAC~1.EXE PID 1636 wrote to memory of 1816 1636 svchost.com 563DAC~1.EXE PID 1816 wrote to memory of 1368 1816 563DAC~1.EXE svchost.com PID 1816 wrote to memory of 1368 1816 563DAC~1.EXE svchost.com PID 1816 wrote to memory of 1368 1816 563DAC~1.EXE svchost.com PID 1816 wrote to memory of 1368 1816 563DAC~1.EXE svchost.com PID 1368 wrote to memory of 2044 1368 svchost.com 563DAC~1.EXE PID 1368 wrote to memory of 2044 1368 svchost.com 563DAC~1.EXE PID 1368 wrote to memory of 2044 1368 svchost.com 563DAC~1.EXE PID 1368 wrote to memory of 2044 1368 svchost.com 563DAC~1.EXE PID 2044 wrote to memory of 592 2044 563DAC~1.EXE svchost.com PID 2044 wrote to memory of 592 2044 563DAC~1.EXE svchost.com PID 2044 wrote to memory of 592 2044 563DAC~1.EXE svchost.com PID 2044 wrote to memory of 592 2044 563DAC~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe"C:\Users\Admin\AppData\Local\Temp\563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\563dacc476669d15b706baaa68900ca21b5722d0af9358632935bfd121dc3a45.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE10⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:300 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE18⤵
- Executes dropped EXE
PID:1648 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE20⤵
- Executes dropped EXE
PID:1536 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE22⤵
- Executes dropped EXE
PID:304 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:308 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE24⤵
- Executes dropped EXE
PID:316 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE26⤵
- Executes dropped EXE
PID:1164 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE28⤵
- Executes dropped EXE
PID:464 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE30⤵
- Executes dropped EXE
PID:1684 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE32⤵
- Executes dropped EXE
PID:932 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE34⤵
- Executes dropped EXE
PID:1932 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE36⤵
- Executes dropped EXE
PID:1800 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE38⤵
- Executes dropped EXE
PID:1552 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE40⤵
- Executes dropped EXE
PID:1532 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:520 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE42⤵
- Executes dropped EXE
PID:1476 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE44⤵
- Executes dropped EXE
PID:540 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE46⤵
- Executes dropped EXE
PID:912 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE48⤵
- Executes dropped EXE
PID:1992 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:308 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE50⤵
- Executes dropped EXE
PID:316 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE52⤵
- Executes dropped EXE
PID:1200 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE54⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1996 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:296 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE56⤵
- Executes dropped EXE
PID:1632 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE58⤵
- Executes dropped EXE
PID:1836 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE60⤵
- Executes dropped EXE
PID:1404 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE62⤵
- Executes dropped EXE
PID:1480 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"63⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE64⤵
- Executes dropped EXE
PID:636 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"65⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE66⤵
- Drops file in Windows directory
PID:1820 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"67⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE68⤵PID:1476
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"69⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE70⤵PID:1648
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"71⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE72⤵PID:1276
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"73⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE74⤵PID:836
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"75⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE76⤵PID:1064
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"77⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE78⤵PID:640
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"79⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE80⤵PID:464
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"81⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE82⤵PID:1996
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"83⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE84⤵PID:1508
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"85⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE86⤵PID:1744
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"87⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE88⤵PID:756
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"89⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE90⤵PID:1008
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"91⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE92⤵PID:1576
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"93⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE94⤵PID:1608
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"95⤵
- Drops file in Windows directory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE96⤵PID:1820
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"97⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE98⤵PID:1476
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"99⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE100⤵PID:1648
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"101⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE102⤵PID:872
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"103⤵
- Drops file in Windows directory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE104⤵PID:836
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"105⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE106⤵PID:1164
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"107⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE108⤵
- Drops file in Windows directory
PID:640 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"109⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE110⤵PID:1520
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"111⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE112⤵PID:1704
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"113⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE114⤵
- Drops file in Windows directory
PID:1624 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"115⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE116⤵PID:1308
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"117⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE118⤵PID:896
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"119⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE120⤵PID:1480
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"121⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE122⤵PID:1232
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"123⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE124⤵PID:892
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"125⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE126⤵PID:1748
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"127⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE128⤵PID:1032
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"129⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE130⤵PID:1076
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"131⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE132⤵PID:1560
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"133⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE134⤵PID:1128
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"135⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE136⤵PID:868
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"137⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE138⤵PID:1592
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"139⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE140⤵PID:1872
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"141⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE142⤵
- Drops file in Windows directory
PID:1704 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"143⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE144⤵PID:1516
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"145⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE146⤵PID:628
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"147⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE148⤵PID:1944
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"149⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE150⤵PID:636
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"151⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE152⤵PID:2024
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"153⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE154⤵PID:1492
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"155⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE156⤵PID:540
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"157⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE158⤵PID:592
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"159⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE160⤵
- Drops file in Windows directory
PID:900 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"161⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE162⤵PID:1560
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"163⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE164⤵PID:1128
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"165⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE166⤵PID:1200
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"167⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE168⤵PID:1520
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"169⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE170⤵PID:296
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"171⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE172⤵PID:1624
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"173⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE174⤵PID:1516
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"175⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE176⤵PID:628
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"177⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE178⤵PID:1944
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"179⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE180⤵PID:1232
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"181⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE182⤵PID:892
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"183⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE184⤵PID:1400
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"185⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE186⤵PID:1992
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"187⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE188⤵PID:940
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"189⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE190⤵PID:1544
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"191⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE192⤵PID:1560
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"193⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE194⤵PID:1128
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"195⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE196⤵PID:1200
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"197⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE181⤵PID:1588
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"182⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE183⤵PID:1536
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"184⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE185⤵PID:1448
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"186⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE187⤵PID:1672
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"188⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE189⤵PID:1972
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"190⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE191⤵PID:2032
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"192⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE193⤵PID:1512
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"194⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE195⤵PID:932
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"196⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE197⤵PID:1996
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"198⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE199⤵PID:1704
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"200⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE201⤵PID:1636
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"202⤵
- Drops file in Windows directory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE203⤵PID:1624
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"204⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE205⤵PID:1204
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"206⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE207⤵PID:1368
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"208⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE209⤵PID:1480
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"210⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE211⤵PID:1232
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"212⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE213⤵PID:1748
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"214⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE215⤵PID:540
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"216⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE217⤵PID:1080
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"218⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE219⤵PID:1064
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"220⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE221⤵PID:1952
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"222⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE223⤵PID:672
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"224⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE225⤵PID:868
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"226⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE227⤵PID:1520
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"228⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE229⤵PID:1340
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"230⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE231⤵PID:1636
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"232⤵
- Drops file in Windows directory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE233⤵PID:1876
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"234⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE235⤵PID:628
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"236⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE237⤵PID:1944
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"238⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE239⤵PID:2024
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE"240⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\563DAC~1.EXE241⤵PID:1492
-