Analysis
-
max time kernel
109s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 08:04
Behavioral task
behavioral1
Sample
9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe
Resource
win10v2004-20220812-en
General
-
Target
9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe
-
Size
291KB
-
MD5
18a788bc27b5416488ffdd71f520ae20
-
SHA1
ce0720e1a6419348f0f3abd1270cca4adac565ec
-
SHA256
9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a
-
SHA512
493aacc53c63d64670c638ac45579b1f79159816bfd87ab7666a394bd8c54c4364a236a7e87c49766f33d95e511d1dc65e41dff7e5a38110c5e5b0819157fd7d
-
SSDEEP
6144:k96QaI8iHZHZM/Pkb7k638rhO+eMs379:3aX55M/aMrhO+eMs3
Malware Config
Signatures
-
Detect Neshta payload 46 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE family_neshta \Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exesvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.compid process 948 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe 1664 svchost.com 1512 9FD4AE~1.EXE 1112 svchost.com 692 9FD4AE~1.EXE 1144 svchost.com 1356 9FD4AE~1.EXE 1364 svchost.com 924 9FD4AE~1.EXE 1172 svchost.com 1632 9FD4AE~1.EXE 808 svchost.com 1880 9FD4AE~1.EXE 1712 svchost.com 1096 9FD4AE~1.EXE 1644 svchost.com 1692 9FD4AE~1.EXE 1216 svchost.com 1168 9FD4AE~1.EXE 824 svchost.com 1396 9FD4AE~1.EXE 876 svchost.com 920 9FD4AE~1.EXE 1756 svchost.com 1524 9FD4AE~1.EXE 1596 svchost.com 1588 9FD4AE~1.EXE 1780 svchost.com 1708 9FD4AE~1.EXE 1540 svchost.com 552 9FD4AE~1.EXE 1632 svchost.com 1608 9FD4AE~1.EXE 1252 svchost.com 608 9FD4AE~1.EXE 1060 svchost.com 2036 9FD4AE~1.EXE 1824 svchost.com 1304 9FD4AE~1.EXE 1552 svchost.com 1644 9FD4AE~1.EXE 1500 svchost.com 1816 9FD4AE~1.EXE 1928 svchost.com 1872 9FD4AE~1.EXE 1396 svchost.com 1532 9FD4AE~1.EXE 920 svchost.com 1508 9FD4AE~1.EXE 1524 svchost.com 1676 9FD4AE~1.EXE 1588 svchost.com 924 9FD4AE~1.EXE 904 svchost.com 668 9FD4AE~1.EXE 1876 svchost.com 1808 9FD4AE~1.EXE 1044 svchost.com 1496 9FD4AE~1.EXE 568 svchost.com 2012 9FD4AE~1.EXE 1712 svchost.com 280 9FD4AE~1.EXE 1304 svchost.com -
Loads dropped DLL 64 IoCs
Processes:
9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.compid process 1284 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe 1284 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe 1664 svchost.com 1664 svchost.com 1112 svchost.com 1112 svchost.com 1144 svchost.com 1144 svchost.com 1364 svchost.com 1364 svchost.com 1172 svchost.com 1172 svchost.com 808 svchost.com 808 svchost.com 1712 svchost.com 1712 svchost.com 1644 svchost.com 1644 svchost.com 1216 svchost.com 1216 svchost.com 824 svchost.com 824 svchost.com 876 svchost.com 876 svchost.com 1756 svchost.com 1756 svchost.com 1596 svchost.com 1596 svchost.com 1780 svchost.com 1780 svchost.com 1540 svchost.com 1540 svchost.com 1632 svchost.com 1632 svchost.com 1252 svchost.com 1252 svchost.com 948 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe 1060 svchost.com 1060 svchost.com 948 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe 1824 svchost.com 1824 svchost.com 1552 svchost.com 1552 svchost.com 1500 svchost.com 1500 svchost.com 1928 svchost.com 1928 svchost.com 1284 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe 1396 svchost.com 1396 svchost.com 920 svchost.com 920 svchost.com 1524 svchost.com 1524 svchost.com 1588 svchost.com 1588 svchost.com 904 svchost.com 904 svchost.com 1876 svchost.com 1876 svchost.com 948 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe 1044 svchost.com 1044 svchost.com -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exedescription ioc process File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe -
Drops file in Windows directory 64 IoCs
Processes:
9FD4AE~1.EXEsvchost.comsvchost.comsvchost.comsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXE9FD4AE~1.EXEsvchost.comsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.comsvchost.com9FD4AE~1.EXEsvchost.comsvchost.comsvchost.comsvchost.com9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXE9FD4AE~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXEdescription ioc process File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys 9FD4AE~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
pid process 860 860 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exesvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEdescription pid process target process PID 1284 wrote to memory of 948 1284 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe PID 1284 wrote to memory of 948 1284 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe PID 1284 wrote to memory of 948 1284 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe PID 1284 wrote to memory of 948 1284 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe PID 948 wrote to memory of 1664 948 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe svchost.com PID 948 wrote to memory of 1664 948 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe svchost.com PID 948 wrote to memory of 1664 948 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe svchost.com PID 948 wrote to memory of 1664 948 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe svchost.com PID 1664 wrote to memory of 1512 1664 svchost.com 9FD4AE~1.EXE PID 1664 wrote to memory of 1512 1664 svchost.com 9FD4AE~1.EXE PID 1664 wrote to memory of 1512 1664 svchost.com 9FD4AE~1.EXE PID 1664 wrote to memory of 1512 1664 svchost.com 9FD4AE~1.EXE PID 1512 wrote to memory of 1112 1512 9FD4AE~1.EXE svchost.com PID 1512 wrote to memory of 1112 1512 9FD4AE~1.EXE svchost.com PID 1512 wrote to memory of 1112 1512 9FD4AE~1.EXE svchost.com PID 1512 wrote to memory of 1112 1512 9FD4AE~1.EXE svchost.com PID 1112 wrote to memory of 692 1112 svchost.com 9FD4AE~1.EXE PID 1112 wrote to memory of 692 1112 svchost.com 9FD4AE~1.EXE PID 1112 wrote to memory of 692 1112 svchost.com 9FD4AE~1.EXE PID 1112 wrote to memory of 692 1112 svchost.com 9FD4AE~1.EXE PID 692 wrote to memory of 1144 692 9FD4AE~1.EXE svchost.com PID 692 wrote to memory of 1144 692 9FD4AE~1.EXE svchost.com PID 692 wrote to memory of 1144 692 9FD4AE~1.EXE svchost.com PID 692 wrote to memory of 1144 692 9FD4AE~1.EXE svchost.com PID 1144 wrote to memory of 1356 1144 svchost.com 9FD4AE~1.EXE PID 1144 wrote to memory of 1356 1144 svchost.com 9FD4AE~1.EXE PID 1144 wrote to memory of 1356 1144 svchost.com 9FD4AE~1.EXE PID 1144 wrote to memory of 1356 1144 svchost.com 9FD4AE~1.EXE PID 1356 wrote to memory of 1364 1356 9FD4AE~1.EXE svchost.com PID 1356 wrote to memory of 1364 1356 9FD4AE~1.EXE svchost.com PID 1356 wrote to memory of 1364 1356 9FD4AE~1.EXE svchost.com PID 1356 wrote to memory of 1364 1356 9FD4AE~1.EXE svchost.com PID 1364 wrote to memory of 924 1364 svchost.com 9FD4AE~1.EXE PID 1364 wrote to memory of 924 1364 svchost.com 9FD4AE~1.EXE PID 1364 wrote to memory of 924 1364 svchost.com 9FD4AE~1.EXE PID 1364 wrote to memory of 924 1364 svchost.com 9FD4AE~1.EXE PID 924 wrote to memory of 1172 924 9FD4AE~1.EXE svchost.com PID 924 wrote to memory of 1172 924 9FD4AE~1.EXE svchost.com PID 924 wrote to memory of 1172 924 9FD4AE~1.EXE svchost.com PID 924 wrote to memory of 1172 924 9FD4AE~1.EXE svchost.com PID 1172 wrote to memory of 1632 1172 svchost.com 9FD4AE~1.EXE PID 1172 wrote to memory of 1632 1172 svchost.com 9FD4AE~1.EXE PID 1172 wrote to memory of 1632 1172 svchost.com 9FD4AE~1.EXE PID 1172 wrote to memory of 1632 1172 svchost.com 9FD4AE~1.EXE PID 1632 wrote to memory of 808 1632 9FD4AE~1.EXE svchost.com PID 1632 wrote to memory of 808 1632 9FD4AE~1.EXE svchost.com PID 1632 wrote to memory of 808 1632 9FD4AE~1.EXE svchost.com PID 1632 wrote to memory of 808 1632 9FD4AE~1.EXE svchost.com PID 808 wrote to memory of 1880 808 svchost.com 9FD4AE~1.EXE PID 808 wrote to memory of 1880 808 svchost.com 9FD4AE~1.EXE PID 808 wrote to memory of 1880 808 svchost.com 9FD4AE~1.EXE PID 808 wrote to memory of 1880 808 svchost.com 9FD4AE~1.EXE PID 1880 wrote to memory of 1712 1880 9FD4AE~1.EXE svchost.com PID 1880 wrote to memory of 1712 1880 9FD4AE~1.EXE svchost.com PID 1880 wrote to memory of 1712 1880 9FD4AE~1.EXE svchost.com PID 1880 wrote to memory of 1712 1880 9FD4AE~1.EXE svchost.com PID 1712 wrote to memory of 1096 1712 svchost.com 9FD4AE~1.EXE PID 1712 wrote to memory of 1096 1712 svchost.com 9FD4AE~1.EXE PID 1712 wrote to memory of 1096 1712 svchost.com 9FD4AE~1.EXE PID 1712 wrote to memory of 1096 1712 svchost.com 9FD4AE~1.EXE PID 1096 wrote to memory of 1644 1096 9FD4AE~1.EXE svchost.com PID 1096 wrote to memory of 1644 1096 9FD4AE~1.EXE svchost.com PID 1096 wrote to memory of 1644 1096 9FD4AE~1.EXE svchost.com PID 1096 wrote to memory of 1644 1096 9FD4AE~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe"C:\Users\Admin\AppData\Local\Temp\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE18⤵
- Executes dropped EXE
PID:1692 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE20⤵
- Executes dropped EXE
PID:1168 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:824 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE22⤵
- Executes dropped EXE
PID:1396 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE24⤵
- Executes dropped EXE
PID:920 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE26⤵
- Executes dropped EXE
PID:1524 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE28⤵
- Executes dropped EXE
PID:1588 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE30⤵
- Executes dropped EXE
PID:1708 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE32⤵
- Executes dropped EXE
PID:552 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE34⤵
- Executes dropped EXE
PID:1608 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE36⤵
- Executes dropped EXE
PID:608 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE38⤵
- Executes dropped EXE
PID:2036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE40⤵
- Executes dropped EXE
PID:1304 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE42⤵
- Executes dropped EXE
PID:1644 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE44⤵
- Executes dropped EXE
PID:1816 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE46⤵
- Executes dropped EXE
PID:1872 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE48⤵
- Executes dropped EXE
PID:1532 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:920 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE50⤵
- Executes dropped EXE
PID:1508 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE52⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1676 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE54⤵
- Executes dropped EXE
PID:924 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE56⤵
- Executes dropped EXE
PID:668 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE58⤵
- Executes dropped EXE
PID:1808 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE60⤵
- Executes dropped EXE
PID:1496 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"61⤵
- Executes dropped EXE
PID:568 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE62⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2012 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"63⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE64⤵
- Executes dropped EXE
PID:280 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"65⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE66⤵PID:972
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"67⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE68⤵PID:1512
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"69⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE70⤵PID:584
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"71⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE72⤵PID:900
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"73⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE74⤵PID:1268
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"75⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE76⤵PID:1592
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"77⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE78⤵PID:1740
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"79⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE80⤵PID:980
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"81⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE82⤵PID:1064
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"83⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE84⤵
- Drops file in Windows directory
PID:1092 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"85⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE86⤵PID:1732
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"87⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE88⤵PID:1044
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"89⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE90⤵PID:1744
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"91⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE92⤵PID:1668
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"93⤵PID:280
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE94⤵PID:1568
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"95⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE96⤵PID:268
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"97⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE98⤵
- Drops file in Windows directory
PID:520 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"99⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE100⤵PID:588
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"101⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE102⤵PID:428
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"103⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE104⤵PID:1356
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"105⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE106⤵PID:1704
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"107⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE108⤵PID:1776
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"109⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE110⤵PID:924
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"111⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE112⤵PID:1164
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"113⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE114⤵PID:1876
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"115⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE116⤵PID:1732
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"117⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE118⤵PID:1044
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"119⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE120⤵PID:1744
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"121⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE122⤵PID:1668
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"123⤵PID:280
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE124⤵PID:1568
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"125⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE126⤵PID:268
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"127⤵
- Drops file in Windows directory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE128⤵PID:520
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"129⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE130⤵PID:588
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"131⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE132⤵PID:428
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"133⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE134⤵PID:1356
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"135⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE136⤵PID:1704
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"137⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE138⤵PID:1776
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"139⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE140⤵PID:924
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"141⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE142⤵PID:1164
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"143⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE144⤵PID:960
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"145⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE146⤵PID:1372
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"147⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE148⤵PID:532
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"149⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE150⤵PID:1680
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"151⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE152⤵PID:1552
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"153⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE154⤵PID:1784
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"155⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE156⤵PID:1112
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"157⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE158⤵PID:520
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"159⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE160⤵PID:588
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"161⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE162⤵PID:560
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"163⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE164⤵PID:1364
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"165⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE166⤵PID:1636
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"167⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE168⤵PID:1520
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"169⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE170⤵PID:1004
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"171⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE172⤵PID:1876
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"173⤵
- Drops file in Windows directory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE174⤵PID:1732
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"175⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE176⤵PID:1108
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"177⤵
- Drops file in Windows directory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE178⤵PID:1692
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"179⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE180⤵PID:1644
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"181⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE182⤵PID:824
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"183⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE184⤵PID:1784
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"185⤵
- Drops file in Windows directory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE186⤵PID:1816
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"187⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE188⤵PID:900
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"189⤵
- Drops file in Windows directory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE190⤵PID:428
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"191⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE192⤵PID:112
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"193⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE194⤵PID:1952
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"195⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE196⤵PID:1776
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"197⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE198⤵PID:924
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"199⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE200⤵PID:1004
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"201⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE202⤵PID:1876
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"203⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE204⤵PID:1732
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"205⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE206⤵PID:912
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"207⤵
- Drops file in Windows directory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE208⤵PID:280
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"209⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE210⤵PID:1664
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"211⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE212⤵PID:1512
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"213⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE214⤵PID:1500
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"215⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE216⤵PID:856
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"217⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE218⤵
- Drops file in Windows directory
PID:920 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"219⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE220⤵PID:1308
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"221⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE222⤵PID:1504
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"223⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE224⤵PID:820
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"225⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE226⤵PID:668
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"227⤵
- Drops file in Windows directory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE228⤵PID:1408
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"229⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE230⤵PID:1496
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"231⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE232⤵PID:1372
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"233⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE234⤵PID:1412
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"235⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE236⤵PID:516
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"237⤵PID:280
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE238⤵PID:1168
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"239⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE240⤵PID:268
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"241⤵PID:1612
-