Analysis
-
max time kernel
155s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 08:04
Behavioral task
behavioral1
Sample
d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe
Resource
win10v2004-20220812-en
General
-
Target
d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe
-
Size
522KB
-
MD5
434f79ef8e264278969782a88c97f7b0
-
SHA1
44c40e7c13eddbfa0eee0062574b3d7e44b49c9a
-
SHA256
d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff
-
SHA512
a45fc8d6c85b27e5dd9ec70ddc8708136e7f90517a21922fd566d965fd3004c5363f5e1145de3d50a82f523d5efd343f336e7993d3390342a073c5d2d58c45cb
-
SSDEEP
6144:k9/UWdbEiGuq1ghByKMIVIa/HbrbfPFJJd1g7RGjQVOqEhNk9r9:gBdbEvghBXcGHb/ftJ5m4QVM
Malware Config
Signatures
-
Detect Neshta payload 35 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\3582-490\d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe family_neshta C:\odt\OFFICE~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe family_neshta C:\Windows\svchost.com family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exesvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.compid process 1140 d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe 728 svchost.com 4428 D778AB~1.EXE 4044 svchost.com 4040 D778AB~1.EXE 4940 svchost.com 5036 D778AB~1.EXE 4700 svchost.com 2296 D778AB~1.EXE 520 svchost.com 2596 D778AB~1.EXE 3884 svchost.com 1060 D778AB~1.EXE 3256 svchost.com 4788 D778AB~1.EXE 912 svchost.com 532 D778AB~1.EXE 1988 svchost.com 2328 D778AB~1.EXE 3248 svchost.com 364 D778AB~1.EXE 4764 svchost.com 4248 D778AB~1.EXE 460 svchost.com 4480 D778AB~1.EXE 3968 svchost.com 5088 D778AB~1.EXE 3996 svchost.com 3732 D778AB~1.EXE 4648 svchost.com 1012 D778AB~1.EXE 5060 svchost.com 720 D778AB~1.EXE 4688 svchost.com 3936 D778AB~1.EXE 2920 svchost.com 1360 D778AB~1.EXE 2832 svchost.com 4140 D778AB~1.EXE 3192 svchost.com 4932 D778AB~1.EXE 1728 svchost.com 4000 D778AB~1.EXE 4136 svchost.com 2696 D778AB~1.EXE 3004 svchost.com 3576 D778AB~1.EXE 3132 svchost.com 2284 D778AB~1.EXE 1224 svchost.com 2264 D778AB~1.EXE 4632 svchost.com 4776 D778AB~1.EXE 4032 svchost.com 2880 D778AB~1.EXE 1672 svchost.com 1880 D778AB~1.EXE 112 svchost.com 4004 D778AB~1.EXE 3960 svchost.com 3748 D778AB~1.EXE 5036 svchost.com 3716 D778AB~1.EXE 3476 svchost.com -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
D778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXEdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation D778AB~1.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exed778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exedescription ioc process File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Install\{9B826~1\MicrosoftEdgeUpdateSetup_X86_1.3.165.21.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~4.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI391D~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI9C33~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MIA062~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~4.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe -
Drops file in Windows directory 64 IoCs
Processes:
D778AB~1.EXEsvchost.comsvchost.comsvchost.comD778AB~1.EXEsvchost.comsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXEsvchost.comD778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comD778AB~1.EXEsvchost.comsvchost.comD778AB~1.EXED778AB~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comD778AB~1.EXED778AB~1.EXEsvchost.comsvchost.comD778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXEsvchost.comsvchost.comD778AB~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comD778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comD778AB~1.EXEsvchost.comdescription ioc process File opened for modification C:\Windows\directx.sys D778AB~1.EXE File opened for modification C:\Windows\svchost.com D778AB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D778AB~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D778AB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys D778AB~1.EXE File opened for modification C:\Windows\directx.sys D778AB~1.EXE File opened for modification C:\Windows\svchost.com D778AB~1.EXE File opened for modification C:\Windows\svchost.com D778AB~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com D778AB~1.EXE File opened for modification C:\Windows\svchost.com D778AB~1.EXE File opened for modification C:\Windows\svchost.com D778AB~1.EXE File opened for modification C:\Windows\directx.sys D778AB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com D778AB~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D778AB~1.EXE File opened for modification C:\Windows\directx.sys D778AB~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys D778AB~1.EXE File opened for modification C:\Windows\directx.sys D778AB~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com D778AB~1.EXE File opened for modification C:\Windows\svchost.com D778AB~1.EXE File opened for modification C:\Windows\directx.sys D778AB~1.EXE File opened for modification C:\Windows\svchost.com D778AB~1.EXE File opened for modification C:\Windows\svchost.com D778AB~1.EXE File opened for modification C:\Windows\directx.sys D778AB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D778AB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D778AB~1.EXE File opened for modification C:\Windows\svchost.com D778AB~1.EXE File opened for modification C:\Windows\directx.sys D778AB~1.EXE File opened for modification C:\Windows\directx.sys D778AB~1.EXE File opened for modification C:\Windows\directx.sys D778AB~1.EXE File opened for modification C:\Windows\directx.sys D778AB~1.EXE File opened for modification C:\Windows\svchost.com D778AB~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys D778AB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
Processes:
D778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXED778AB~1.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings D778AB~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exed778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exesvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEsvchost.comD778AB~1.EXEdescription pid process target process PID 4264 wrote to memory of 1140 4264 d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe PID 4264 wrote to memory of 1140 4264 d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe PID 4264 wrote to memory of 1140 4264 d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe PID 1140 wrote to memory of 728 1140 d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe svchost.com PID 1140 wrote to memory of 728 1140 d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe svchost.com PID 1140 wrote to memory of 728 1140 d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe svchost.com PID 728 wrote to memory of 4428 728 svchost.com D778AB~1.EXE PID 728 wrote to memory of 4428 728 svchost.com D778AB~1.EXE PID 728 wrote to memory of 4428 728 svchost.com D778AB~1.EXE PID 4428 wrote to memory of 4044 4428 D778AB~1.EXE svchost.com PID 4428 wrote to memory of 4044 4428 D778AB~1.EXE svchost.com PID 4428 wrote to memory of 4044 4428 D778AB~1.EXE svchost.com PID 4044 wrote to memory of 4040 4044 svchost.com D778AB~1.EXE PID 4044 wrote to memory of 4040 4044 svchost.com D778AB~1.EXE PID 4044 wrote to memory of 4040 4044 svchost.com D778AB~1.EXE PID 4040 wrote to memory of 4940 4040 D778AB~1.EXE svchost.com PID 4040 wrote to memory of 4940 4040 D778AB~1.EXE svchost.com PID 4040 wrote to memory of 4940 4040 D778AB~1.EXE svchost.com PID 4940 wrote to memory of 5036 4940 svchost.com D778AB~1.EXE PID 4940 wrote to memory of 5036 4940 svchost.com D778AB~1.EXE PID 4940 wrote to memory of 5036 4940 svchost.com D778AB~1.EXE PID 5036 wrote to memory of 4700 5036 D778AB~1.EXE svchost.com PID 5036 wrote to memory of 4700 5036 D778AB~1.EXE svchost.com PID 5036 wrote to memory of 4700 5036 D778AB~1.EXE svchost.com PID 4700 wrote to memory of 2296 4700 svchost.com D778AB~1.EXE PID 4700 wrote to memory of 2296 4700 svchost.com D778AB~1.EXE PID 4700 wrote to memory of 2296 4700 svchost.com D778AB~1.EXE PID 2296 wrote to memory of 520 2296 D778AB~1.EXE svchost.com PID 2296 wrote to memory of 520 2296 D778AB~1.EXE svchost.com PID 2296 wrote to memory of 520 2296 D778AB~1.EXE svchost.com PID 520 wrote to memory of 2596 520 svchost.com D778AB~1.EXE PID 520 wrote to memory of 2596 520 svchost.com D778AB~1.EXE PID 520 wrote to memory of 2596 520 svchost.com D778AB~1.EXE PID 2596 wrote to memory of 3884 2596 D778AB~1.EXE svchost.com PID 2596 wrote to memory of 3884 2596 D778AB~1.EXE svchost.com PID 2596 wrote to memory of 3884 2596 D778AB~1.EXE svchost.com PID 3884 wrote to memory of 1060 3884 svchost.com D778AB~1.EXE PID 3884 wrote to memory of 1060 3884 svchost.com D778AB~1.EXE PID 3884 wrote to memory of 1060 3884 svchost.com D778AB~1.EXE PID 1060 wrote to memory of 3256 1060 D778AB~1.EXE svchost.com PID 1060 wrote to memory of 3256 1060 D778AB~1.EXE svchost.com PID 1060 wrote to memory of 3256 1060 D778AB~1.EXE svchost.com PID 3256 wrote to memory of 4788 3256 svchost.com D778AB~1.EXE PID 3256 wrote to memory of 4788 3256 svchost.com D778AB~1.EXE PID 3256 wrote to memory of 4788 3256 svchost.com D778AB~1.EXE PID 4788 wrote to memory of 912 4788 D778AB~1.EXE svchost.com PID 4788 wrote to memory of 912 4788 D778AB~1.EXE svchost.com PID 4788 wrote to memory of 912 4788 D778AB~1.EXE svchost.com PID 912 wrote to memory of 532 912 svchost.com D778AB~1.EXE PID 912 wrote to memory of 532 912 svchost.com D778AB~1.EXE PID 912 wrote to memory of 532 912 svchost.com D778AB~1.EXE PID 532 wrote to memory of 1988 532 D778AB~1.EXE svchost.com PID 532 wrote to memory of 1988 532 D778AB~1.EXE svchost.com PID 532 wrote to memory of 1988 532 D778AB~1.EXE svchost.com PID 1988 wrote to memory of 2328 1988 svchost.com D778AB~1.EXE PID 1988 wrote to memory of 2328 1988 svchost.com D778AB~1.EXE PID 1988 wrote to memory of 2328 1988 svchost.com D778AB~1.EXE PID 2328 wrote to memory of 3248 2328 D778AB~1.EXE svchost.com PID 2328 wrote to memory of 3248 2328 D778AB~1.EXE svchost.com PID 2328 wrote to memory of 3248 2328 D778AB~1.EXE svchost.com PID 3248 wrote to memory of 364 3248 svchost.com D778AB~1.EXE PID 3248 wrote to memory of 364 3248 svchost.com D778AB~1.EXE PID 3248 wrote to memory of 364 3248 svchost.com D778AB~1.EXE PID 364 wrote to memory of 4764 364 D778AB~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe"C:\Users\Admin\AppData\Local\Temp\d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\3582-490\d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\d778ab965f0e5b72c454af87e07fbc0c7128683c972bc070af4f87052879beff.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE6⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE10⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE12⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE14⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"23⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE24⤵
- Executes dropped EXE
- Checks computer location settings
PID:4248 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"25⤵
- Executes dropped EXE
PID:460 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE26⤵
- Executes dropped EXE
PID:4480 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"27⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE28⤵
- Executes dropped EXE
- Modifies registry class
PID:5088 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"29⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE30⤵
- Executes dropped EXE
PID:3732 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"31⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE32⤵
- Executes dropped EXE
PID:1012 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"33⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE34⤵
- Executes dropped EXE
PID:720 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"35⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE36⤵
- Executes dropped EXE
PID:3936 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"37⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE38⤵
- Executes dropped EXE
PID:1360 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"39⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE40⤵
- Executes dropped EXE
PID:4140 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"41⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE42⤵
- Executes dropped EXE
PID:4932 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"43⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE44⤵
- Executes dropped EXE
- Modifies registry class
PID:4000 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"45⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE46⤵
- Executes dropped EXE
PID:2696 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"47⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE48⤵
- Executes dropped EXE
PID:3576 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"49⤵
- Executes dropped EXE
PID:3132
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE1⤵
- Executes dropped EXE
- Checks computer location settings
PID:2284 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"2⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE3⤵
- Executes dropped EXE
- Checks computer location settings
PID:2264 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"4⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE5⤵
- Executes dropped EXE
PID:4776 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"6⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE7⤵
- Executes dropped EXE
- Modifies registry class
PID:2880 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"8⤵
- Executes dropped EXE
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE9⤵
- Executes dropped EXE
PID:1880 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"10⤵
- Executes dropped EXE
PID:112 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE11⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Windows directory
PID:4004 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"12⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE13⤵
- Executes dropped EXE
PID:3748 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"14⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE15⤵
- Executes dropped EXE
PID:3716 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"16⤵
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE17⤵PID:4388
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"18⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE19⤵PID:3100
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"20⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE21⤵PID:1748
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"22⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE1⤵PID:1060
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"2⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE3⤵
- Modifies registry class
PID:4560 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"4⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE5⤵PID:1512
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"6⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE7⤵PID:1888
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"8⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE9⤵PID:2328
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"10⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE11⤵PID:3844
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"12⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE13⤵PID:5100
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"14⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE15⤵PID:444
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"16⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE17⤵
- Checks computer location settings
PID:3776 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"18⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE19⤵
- Checks computer location settings
PID:4564 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"20⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE21⤵PID:4340
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"22⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE23⤵
- Modifies registry class
PID:4544 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"24⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE25⤵
- Checks computer location settings
PID:408 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"26⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE27⤵PID:4512
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"28⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE29⤵PID:4872
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"30⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE1⤵PID:2832
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"2⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE3⤵PID:3056
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"4⤵
- Drops file in Windows directory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE5⤵PID:4088
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"6⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE7⤵PID:2860
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"8⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE9⤵PID:2696
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"10⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE11⤵PID:5096
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"12⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE13⤵PID:3772
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"14⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE15⤵PID:3596
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"16⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE17⤵
- Checks computer location settings
PID:5020 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"18⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE19⤵
- Modifies registry class
PID:2880 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"20⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE21⤵
- Drops file in Windows directory
PID:2748 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"22⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE23⤵PID:3752
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"24⤵
- Drops file in Windows directory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE25⤵
- Drops file in Windows directory
PID:4124 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"26⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE27⤵PID:4668
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"28⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE29⤵PID:2296
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"30⤵
- Drops file in Windows directory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE31⤵PID:4132
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"32⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE33⤵PID:4492
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"34⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE35⤵PID:4348
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"36⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE37⤵PID:1276
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"38⤵
- Drops file in Windows directory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE39⤵
- Modifies registry class
PID:1912 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"40⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE41⤵PID:2508
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"42⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE43⤵PID:3096
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"44⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE45⤵PID:364
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"46⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE47⤵PID:792
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"48⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE49⤵
- Drops file in Windows directory
PID:4912 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"50⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE51⤵PID:3776
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"52⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE53⤵
- Checks computer location settings
PID:3800 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"54⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE55⤵PID:4340
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"56⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE57⤵PID:4544
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"58⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE59⤵PID:4924
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"60⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE61⤵PID:4424
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"62⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE63⤵PID:3760
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"64⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE65⤵PID:4240
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"66⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE67⤵
- Modifies registry class
PID:4932 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"68⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE69⤵PID:4888
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"70⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE71⤵PID:2672
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"72⤵
- Drops file in Windows directory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE73⤵
- Drops file in Windows directory
PID:4380 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"74⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE75⤵
- Modifies registry class
PID:1116 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"76⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE1⤵
- Checks computer location settings
- Drops file in Windows directory
PID:3068 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"2⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE3⤵
- Modifies registry class
PID:4032 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"4⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE5⤵
- Modifies registry class
PID:260 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"6⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE7⤵
- Checks computer location settings
PID:1044 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"8⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE9⤵
- Drops file in Windows directory
PID:3748 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"10⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE11⤵PID:4668
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"12⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE13⤵PID:2296
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"14⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE15⤵PID:2492
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"16⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE17⤵
- Checks computer location settings
PID:1712 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"18⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE19⤵PID:1212
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"20⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE21⤵PID:3980
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"22⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE23⤵PID:2336
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"24⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE25⤵PID:3340
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"26⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE27⤵PID:3432
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"28⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE29⤵PID:4592
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"30⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE31⤵PID:2988
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"32⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE33⤵
- Checks computer location settings
- Modifies registry class
PID:3996 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"34⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE35⤵PID:4308
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"36⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE37⤵
- Checks computer location settings
PID:1012 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"38⤵
- Drops file in Windows directory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE39⤵PID:5048
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"40⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE41⤵PID:3936
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"42⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE43⤵PID:2608
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"44⤵
- Drops file in Windows directory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE45⤵PID:4272
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"46⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE47⤵PID:4984
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"48⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE49⤵
- Modifies registry class
PID:3932 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"50⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE51⤵PID:396
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"52⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE53⤵PID:2696
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"54⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE55⤵
- Modifies registry class
PID:644 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"56⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE57⤵
- Modifies registry class
PID:2380 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"58⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE59⤵
- Checks computer location settings
PID:2112 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"60⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE61⤵
- Checks computer location settings
PID:3948 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"62⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE63⤵
- Checks computer location settings
PID:220 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"64⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE65⤵PID:3544
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"66⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE67⤵PID:3568
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"68⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE69⤵PID:2096
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"70⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE71⤵
- Drops file in Windows directory
PID:804 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"72⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE73⤵
- Modifies registry class
PID:3972 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"74⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE75⤵
- Modifies registry class
PID:2200 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"76⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE77⤵PID:4492
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"78⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE79⤵
- Checks computer location settings
PID:1712 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"80⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE81⤵PID:1276
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"82⤵
- Drops file in Windows directory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE83⤵
- Modifies registry class
PID:2272 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"84⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE85⤵
- Checks computer location settings
PID:2508 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"86⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE87⤵
- Modifies registry class
PID:3096 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"88⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE89⤵PID:4808
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"90⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE91⤵
- Drops file in Windows directory
PID:4592 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"92⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE93⤵PID:3540
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"94⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE95⤵PID:4876
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"96⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE97⤵
- Checks computer location settings
- Modifies registry class
PID:4340 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"98⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE99⤵
- Checks computer location settings
PID:2920 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"100⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE101⤵PID:2608
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"102⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE103⤵
- Checks computer location settings
- Drops file in Windows directory
PID:4272 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"104⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE105⤵
- Modifies registry class
PID:5024 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"106⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE107⤵
- Modifies registry class
PID:1732 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"108⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE109⤵PID:2696
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"110⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE111⤵PID:2284
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"112⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE113⤵
- Drops file in Windows directory
PID:1936 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"114⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE115⤵PID:208
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"116⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE117⤵
- Checks computer location settings
PID:2728 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"118⤵
- Drops file in Windows directory
PID:1476
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3892 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"2⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE3⤵PID:5036
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"4⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE5⤵PID:4320
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"6⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE7⤵PID:2256
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"8⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE9⤵
- Modifies registry class
PID:4208 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"10⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE11⤵PID:3100
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"12⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE13⤵PID:1992
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"14⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE15⤵
- Modifies registry class
PID:3512 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"16⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE17⤵
- Checks computer location settings
- Modifies registry class
PID:1316 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"18⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE19⤵
- Checks computer location settings
PID:3460 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"20⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE21⤵PID:3248
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"22⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE23⤵PID:5056
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"24⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE25⤵PID:1924
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"26⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE27⤵PID:1784
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"28⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE29⤵
- Checks computer location settings
PID:712 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"30⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE31⤵PID:4712
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"32⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE33⤵PID:4820
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"34⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE35⤵
- Modifies registry class
PID:4280 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"36⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE37⤵PID:4584
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"38⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE39⤵PID:3808
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"40⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE41⤵PID:2800
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"42⤵PID:508
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE43⤵PID:2084
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"44⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE45⤵PID:4888
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"46⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE47⤵PID:1952
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"48⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE49⤵
- Checks computer location settings
PID:2380 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"50⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE51⤵PID:4856
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"52⤵
- Drops file in Windows directory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE53⤵PID:3888
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"54⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE55⤵PID:212
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"56⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE57⤵
- Drops file in Windows directory
PID:4612 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"58⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE59⤵
- Drops file in Windows directory
PID:4520 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"60⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE61⤵PID:3476
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"62⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE63⤵PID:4852
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"64⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE65⤵PID:2256
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"66⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE67⤵PID:4208
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"68⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE69⤵PID:1908
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"70⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE71⤵PID:4348
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"72⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE73⤵
- Checks computer location settings
PID:912 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"74⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE75⤵PID:1212
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"76⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE77⤵
- Checks computer location settings
PID:2316 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"78⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE79⤵PID:2328
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"80⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE81⤵PID:4812
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"82⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE83⤵
- Checks computer location settings
PID:4764 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"84⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE85⤵PID:3024
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"86⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE87⤵PID:2224
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"88⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE89⤵
- Checks computer location settings
- Modifies registry class
PID:3148 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"90⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE91⤵PID:4008
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"92⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE93⤵
- Checks computer location settings
PID:1452 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"94⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE95⤵PID:4340
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"96⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE97⤵PID:4880
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"98⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE99⤵
- Modifies registry class
PID:4140 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"100⤵
- Drops file in Windows directory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE101⤵
- Checks computer location settings
PID:508 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"102⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE103⤵PID:5024
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"104⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE105⤵PID:3576
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"106⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE107⤵PID:4180
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"108⤵
- Drops file in Windows directory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE109⤵
- Modifies registry class
PID:4896 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"110⤵
- Drops file in Windows directory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE111⤵
- Drops file in Windows directory
PID:4772 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"112⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE113⤵
- Drops file in Windows directory
PID:4776 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"114⤵PID:260
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE115⤵PID:2728
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"116⤵
- Drops file in Windows directory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE117⤵
- Drops file in Windows directory
PID:2636 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"118⤵
- Drops file in Windows directory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE119⤵PID:4704
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"120⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE121⤵PID:3688
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"122⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE123⤵PID:3068
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"124⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE125⤵PID:2644
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"126⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE127⤵
- Checks computer location settings
PID:2292 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"128⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE129⤵PID:1060
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"130⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE131⤵PID:2392
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"132⤵
- Drops file in Windows directory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE133⤵PID:1988
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"134⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE135⤵
- Checks computer location settings
PID:524 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"136⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE137⤵PID:3844
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"138⤵
- Drops file in Windows directory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE139⤵PID:3432
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"140⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE141⤵
- Modifies registry class
PID:4168 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"142⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE143⤵PID:4976
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"144⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE145⤵
- Drops file in Windows directory
PID:620 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"146⤵
- Drops file in Windows directory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE147⤵
- Drops file in Windows directory
PID:5048 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"148⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE149⤵
- Modifies registry class
PID:3628 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"150⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE151⤵
- Modifies registry class
PID:5064 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"152⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE153⤵
- Checks computer location settings
PID:4868 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"154⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE155⤵PID:4616
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"156⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE157⤵PID:3436
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"158⤵
- Drops file in Windows directory
PID:720 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE159⤵PID:396
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"160⤵
- Drops file in Windows directory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE161⤵PID:2672
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"162⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE163⤵PID:668
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"164⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE165⤵PID:1116
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"166⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE167⤵PID:3328
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"168⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE169⤵
- Modifies registry class
PID:3940 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"170⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE171⤵
- Modifies registry class
PID:2964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"172⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE173⤵
- Checks computer location settings
- Drops file in Windows directory
PID:2324 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"174⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE175⤵PID:3196
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"176⤵
- Drops file in Windows directory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE177⤵
- Checks computer location settings
PID:4660 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"178⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE179⤵PID:1856
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"180⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE181⤵PID:2296
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"182⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE183⤵PID:3972
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"184⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE185⤵PID:1108
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"186⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE187⤵PID:3392
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"188⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE189⤵PID:3512
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"190⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE191⤵PID:4724
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"192⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE193⤵PID:3824
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"194⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE195⤵PID:1760
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"196⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE197⤵PID:3496
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"198⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE199⤵PID:2736
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"200⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE201⤵PID:1372
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"202⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE203⤵PID:4364
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"204⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE205⤵
- Drops file in Windows directory
- Modifies registry class
PID:5000 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"206⤵
- Drops file in Windows directory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE207⤵PID:764
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"208⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE209⤵PID:5060
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"210⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE211⤵
- Checks computer location settings
- Modifies registry class
PID:3484 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"212⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE213⤵PID:3288
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"214⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE215⤵PID:4100
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"216⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE217⤵PID:2832
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"218⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE219⤵PID:3464
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"220⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE221⤵
- Checks computer location settings
PID:3032 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"222⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE223⤵
- Checks computer location settings
- Modifies registry class
PID:1308 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"224⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE225⤵
- Modifies registry class
PID:4744 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"226⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE227⤵
- Checks computer location settings
- Modifies registry class
PID:1800 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"228⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE229⤵PID:2192
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"230⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE231⤵
- Drops file in Windows directory
PID:1880 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"232⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE233⤵PID:112
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"234⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE235⤵PID:2964
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"236⤵
- Drops file in Windows directory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE237⤵PID:2324
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"238⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE239⤵
- Modifies registry class
PID:3196 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE"240⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D778AB~1.EXE241⤵
- Drops file in Windows directory
- Modifies registry class
PID:4388 -