Analysis
-
max time kernel
154s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 08:04
Behavioral task
behavioral1
Sample
9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe
Resource
win10v2004-20220812-en
General
-
Target
9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe
-
Size
291KB
-
MD5
18a788bc27b5416488ffdd71f520ae20
-
SHA1
ce0720e1a6419348f0f3abd1270cca4adac565ec
-
SHA256
9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a
-
SHA512
493aacc53c63d64670c638ac45579b1f79159816bfd87ab7666a394bd8c54c4364a236a7e87c49766f33d95e511d1dc65e41dff7e5a38110c5e5b0819157fd7d
-
SSDEEP
6144:k96QaI8iHZHZM/Pkb7k638rhO+eMs379:3aX55M/aMrhO+eMs3
Malware Config
Signatures
-
Detect Neshta payload 34 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe family_neshta C:\Windows\svchost.com family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exesvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.compid process 5024 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe 4076 svchost.com 2276 9FD4AE~1.EXE 1812 svchost.com 2984 9FD4AE~1.EXE 4552 svchost.com 2496 9FD4AE~1.EXE 2092 svchost.com 3184 9FD4AE~1.EXE 204 svchost.com 4784 9FD4AE~1.EXE 4832 svchost.com 1508 9FD4AE~1.EXE 3144 svchost.com 4964 9FD4AE~1.EXE 3996 svchost.com 3872 9FD4AE~1.EXE 2252 svchost.com 4608 9FD4AE~1.EXE 3616 svchost.com 1100 9FD4AE~1.EXE 3320 svchost.com 4428 9FD4AE~1.EXE 4036 svchost.com 3816 9FD4AE~1.EXE 3524 svchost.com 1068 9FD4AE~1.EXE 1576 svchost.com 2172 9FD4AE~1.EXE 796 svchost.com 5112 9FD4AE~1.EXE 1924 svchost.com 4456 9FD4AE~1.EXE 3292 svchost.com 4536 9FD4AE~1.EXE 4352 svchost.com 3084 9FD4AE~1.EXE 3020 svchost.com 1432 9FD4AE~1.EXE 3448 svchost.com 1112 9FD4AE~1.EXE 1416 svchost.com 2244 9FD4AE~1.EXE 1688 svchost.com 3056 9FD4AE~1.EXE 3660 svchost.com 1472 9FD4AE~1.EXE 1096 svchost.com 2280 9FD4AE~1.EXE 3100 svchost.com 3972 9FD4AE~1.EXE 3716 svchost.com 3232 9FD4AE~1.EXE 4620 svchost.com 2140 9FD4AE~1.EXE 3328 svchost.com 3312 9FD4AE~1.EXE 612 svchost.com 804 9FD4AE~1.EXE 1056 svchost.com 4056 9FD4AE~1.EXE 3568 svchost.com 204 9FD4AE~1.EXE 4804 svchost.com -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXEdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9FD4AE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exedescription ioc process File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\COOKIE~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI391D~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\NOTIFI~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MIA062~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\msedge.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~4.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~4.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~2.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MIA062~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13165~1.21\MICROS~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\MSEDGE~3.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\IDENTI~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\ELEVAT~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\MSEDGE~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe -
Drops file in Windows directory 64 IoCs
Processes:
svchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXEsvchost.com9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXEsvchost.com9FD4AE~1.EXE9FD4AE~1.EXEsvchost.comsvchost.com9FD4AE~1.EXE9FD4AE~1.EXEsvchost.com9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXEsvchost.comsvchost.comsvchost.com9FD4AE~1.EXEsvchost.comsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXEdescription ioc process File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE File opened for modification C:\Windows\svchost.com 9FD4AE~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
Processes:
9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXE9FD4AE~1.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9FD4AE~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exesvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEsvchost.com9FD4AE~1.EXEdescription pid process target process PID 5072 wrote to memory of 5024 5072 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe PID 5072 wrote to memory of 5024 5072 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe PID 5072 wrote to memory of 5024 5072 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe PID 5024 wrote to memory of 4076 5024 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe svchost.com PID 5024 wrote to memory of 4076 5024 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe svchost.com PID 5024 wrote to memory of 4076 5024 9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe svchost.com PID 4076 wrote to memory of 2276 4076 svchost.com 9FD4AE~1.EXE PID 4076 wrote to memory of 2276 4076 svchost.com 9FD4AE~1.EXE PID 4076 wrote to memory of 2276 4076 svchost.com 9FD4AE~1.EXE PID 2276 wrote to memory of 1812 2276 9FD4AE~1.EXE svchost.com PID 2276 wrote to memory of 1812 2276 9FD4AE~1.EXE svchost.com PID 2276 wrote to memory of 1812 2276 9FD4AE~1.EXE svchost.com PID 1812 wrote to memory of 2984 1812 svchost.com 9FD4AE~1.EXE PID 1812 wrote to memory of 2984 1812 svchost.com 9FD4AE~1.EXE PID 1812 wrote to memory of 2984 1812 svchost.com 9FD4AE~1.EXE PID 2984 wrote to memory of 4552 2984 9FD4AE~1.EXE svchost.com PID 2984 wrote to memory of 4552 2984 9FD4AE~1.EXE svchost.com PID 2984 wrote to memory of 4552 2984 9FD4AE~1.EXE svchost.com PID 4552 wrote to memory of 2496 4552 svchost.com 9FD4AE~1.EXE PID 4552 wrote to memory of 2496 4552 svchost.com 9FD4AE~1.EXE PID 4552 wrote to memory of 2496 4552 svchost.com 9FD4AE~1.EXE PID 2496 wrote to memory of 2092 2496 9FD4AE~1.EXE svchost.com PID 2496 wrote to memory of 2092 2496 9FD4AE~1.EXE svchost.com PID 2496 wrote to memory of 2092 2496 9FD4AE~1.EXE svchost.com PID 2092 wrote to memory of 3184 2092 svchost.com 9FD4AE~1.EXE PID 2092 wrote to memory of 3184 2092 svchost.com 9FD4AE~1.EXE PID 2092 wrote to memory of 3184 2092 svchost.com 9FD4AE~1.EXE PID 3184 wrote to memory of 204 3184 9FD4AE~1.EXE svchost.com PID 3184 wrote to memory of 204 3184 9FD4AE~1.EXE svchost.com PID 3184 wrote to memory of 204 3184 9FD4AE~1.EXE svchost.com PID 204 wrote to memory of 4784 204 svchost.com 9FD4AE~1.EXE PID 204 wrote to memory of 4784 204 svchost.com 9FD4AE~1.EXE PID 204 wrote to memory of 4784 204 svchost.com 9FD4AE~1.EXE PID 4784 wrote to memory of 4832 4784 9FD4AE~1.EXE svchost.com PID 4784 wrote to memory of 4832 4784 9FD4AE~1.EXE svchost.com PID 4784 wrote to memory of 4832 4784 9FD4AE~1.EXE svchost.com PID 4832 wrote to memory of 1508 4832 svchost.com 9FD4AE~1.EXE PID 4832 wrote to memory of 1508 4832 svchost.com 9FD4AE~1.EXE PID 4832 wrote to memory of 1508 4832 svchost.com 9FD4AE~1.EXE PID 1508 wrote to memory of 3144 1508 9FD4AE~1.EXE svchost.com PID 1508 wrote to memory of 3144 1508 9FD4AE~1.EXE svchost.com PID 1508 wrote to memory of 3144 1508 9FD4AE~1.EXE svchost.com PID 3144 wrote to memory of 4964 3144 svchost.com 9FD4AE~1.EXE PID 3144 wrote to memory of 4964 3144 svchost.com 9FD4AE~1.EXE PID 3144 wrote to memory of 4964 3144 svchost.com 9FD4AE~1.EXE PID 4964 wrote to memory of 3996 4964 9FD4AE~1.EXE svchost.com PID 4964 wrote to memory of 3996 4964 9FD4AE~1.EXE svchost.com PID 4964 wrote to memory of 3996 4964 9FD4AE~1.EXE svchost.com PID 3996 wrote to memory of 3872 3996 svchost.com 9FD4AE~1.EXE PID 3996 wrote to memory of 3872 3996 svchost.com 9FD4AE~1.EXE PID 3996 wrote to memory of 3872 3996 svchost.com 9FD4AE~1.EXE PID 3872 wrote to memory of 2252 3872 9FD4AE~1.EXE svchost.com PID 3872 wrote to memory of 2252 3872 9FD4AE~1.EXE svchost.com PID 3872 wrote to memory of 2252 3872 9FD4AE~1.EXE svchost.com PID 2252 wrote to memory of 4608 2252 svchost.com 9FD4AE~1.EXE PID 2252 wrote to memory of 4608 2252 svchost.com 9FD4AE~1.EXE PID 2252 wrote to memory of 4608 2252 svchost.com 9FD4AE~1.EXE PID 4608 wrote to memory of 3616 4608 9FD4AE~1.EXE svchost.com PID 4608 wrote to memory of 3616 4608 9FD4AE~1.EXE svchost.com PID 4608 wrote to memory of 3616 4608 9FD4AE~1.EXE svchost.com PID 3616 wrote to memory of 1100 3616 svchost.com 9FD4AE~1.EXE PID 3616 wrote to memory of 1100 3616 svchost.com 9FD4AE~1.EXE PID 3616 wrote to memory of 1100 3616 svchost.com 9FD4AE~1.EXE PID 1100 wrote to memory of 3320 1100 9FD4AE~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe"C:\Users\Admin\AppData\Local\Temp\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\9fd4aeaf98697763e5a41bad321c756008bdd4b792c96fcee50dcdda39c0ce9a.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE8⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE12⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE16⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE20⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE22⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"23⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE24⤵
- Executes dropped EXE
PID:4428 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"25⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE26⤵
- Executes dropped EXE
PID:3816 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"27⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE28⤵
- Executes dropped EXE
- Checks computer location settings
PID:1068 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"29⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE30⤵
- Executes dropped EXE
PID:2172 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"31⤵
- Executes dropped EXE
PID:796 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE32⤵
- Executes dropped EXE
- Checks computer location settings
PID:5112 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"33⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE34⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4456 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"35⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE36⤵
- Executes dropped EXE
- Modifies registry class
PID:4536 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"37⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE38⤵
- Executes dropped EXE
PID:3084 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"39⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE40⤵
- Executes dropped EXE
PID:1432 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"41⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE42⤵
- Executes dropped EXE
PID:1112 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"43⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE44⤵
- Executes dropped EXE
PID:2244 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"45⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE46⤵
- Executes dropped EXE
PID:3056 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"47⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE48⤵
- Executes dropped EXE
PID:1472 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"49⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE50⤵
- Executes dropped EXE
PID:2280 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"51⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE52⤵
- Executes dropped EXE
PID:3972 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"53⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE54⤵
- Executes dropped EXE
PID:3232 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"55⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE56⤵
- Executes dropped EXE
PID:2140 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"57⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE58⤵
- Executes dropped EXE
- Modifies registry class
PID:3312 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"59⤵
- Executes dropped EXE
PID:612 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE60⤵
- Executes dropped EXE
- Checks computer location settings
PID:804 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"61⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE62⤵
- Executes dropped EXE
- Modifies registry class
PID:4056 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"63⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE64⤵
- Executes dropped EXE
PID:204 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"65⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE66⤵PID:4516
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"67⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE68⤵
- Modifies registry class
PID:4480 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"69⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE70⤵PID:1012
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"71⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE72⤵PID:3872
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"73⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE74⤵PID:4512
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"75⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE76⤵PID:2964
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"77⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE78⤵PID:2388
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"79⤵
- Drops file in Windows directory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE80⤵PID:4504
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"81⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE82⤵PID:2756
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"83⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE84⤵PID:3816
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"85⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE86⤵PID:4672
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"87⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE88⤵PID:2088
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"89⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE90⤵PID:4860
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"91⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE92⤵
- Drops file in Windows directory
PID:4572 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"93⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE94⤵PID:1412
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"95⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE96⤵
- Checks computer location settings
PID:3292 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"97⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE98⤵PID:3604
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"99⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE100⤵
- Checks computer location settings
PID:5096 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"101⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE102⤵PID:4752
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"103⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE104⤵PID:1112
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"105⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE106⤵PID:444
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"107⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE108⤵
- Checks computer location settings
PID:1896 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"109⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE110⤵
- Modifies registry class
PID:3088 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"111⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE112⤵PID:4068
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"113⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE114⤵PID:5032
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"115⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE116⤵PID:3716
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"117⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE118⤵PID:4472
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"119⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE120⤵PID:4276
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"121⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE122⤵
- Modifies registry class
PID:3312 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"123⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE124⤵PID:2044
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"125⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE126⤵PID:260
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"127⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE128⤵PID:2872
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"129⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE130⤵PID:2236
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"131⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE132⤵PID:4224
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"133⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE134⤵PID:4780
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"135⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE136⤵PID:1268
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"137⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE138⤵PID:616
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"139⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE140⤵
- Checks computer location settings
PID:3260 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"141⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE142⤵PID:3896
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"143⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE144⤵PID:904
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"145⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE146⤵
- Drops file in Windows directory
PID:3408 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"147⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE148⤵
- Modifies registry class
PID:1576 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"149⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE150⤵
- Modifies registry class
PID:1248 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"151⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE152⤵PID:4872
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"153⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE154⤵PID:2476
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"155⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE156⤵PID:3948
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"157⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE158⤵PID:900
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"159⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE160⤵PID:3416
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"161⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE162⤵PID:4676
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"163⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE164⤵
- Modifies registry class
PID:2244 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"165⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE166⤵PID:5092
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"167⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE168⤵PID:3904
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"169⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE170⤵
- Modifies registry class
PID:3964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"171⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE172⤵PID:5032
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"173⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE174⤵PID:4076
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"175⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE176⤵PID:1812
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"177⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE178⤵PID:3512
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"179⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE180⤵PID:3976
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"181⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE182⤵
- Modifies registry class
PID:1056 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"183⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE184⤵PID:4316
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"185⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE186⤵PID:2596
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"187⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE188⤵PID:1876
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"189⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE190⤵PID:4876
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"191⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE192⤵
- Modifies registry class
PID:4780 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"193⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE194⤵PID:1540
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"195⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE196⤵PID:2788
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"197⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE198⤵PID:3320
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"199⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE200⤵PID:4840
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"201⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE202⤵PID:1820
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"203⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE204⤵PID:1548
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"205⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE206⤵PID:1120
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"207⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE208⤵PID:4080
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"209⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE210⤵
- Drops file in Windows directory
PID:4616 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"211⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE212⤵PID:3644
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"213⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE214⤵
- Checks computer location settings
PID:3084 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"215⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE216⤵PID:1792
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"217⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE218⤵PID:1416
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"219⤵
- Drops file in Windows directory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE220⤵PID:1492
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"221⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE222⤵
- Checks computer location settings
PID:1860 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"223⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE224⤵
- Modifies registry class
PID:868 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"225⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE226⤵PID:3356
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"227⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE228⤵PID:2468
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"229⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE230⤵PID:2680
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"231⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE232⤵PID:2140
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"233⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE234⤵PID:3512
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"235⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE236⤵PID:3228
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"237⤵PID:100
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE238⤵
- Modifies registry class
PID:804 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"239⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE240⤵PID:4488
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9FD4AE~1.EXE"241⤵PID:4816
-