Analysis
-
max time kernel
163s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 08:04
Behavioral task
behavioral1
Sample
6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe
Resource
win10v2004-20221111-en
General
-
Target
6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe
-
Size
536KB
-
MD5
3e34aa903d09bd824af20d8e7d16248d
-
SHA1
c17b17c0dad5afb6a2b2348be4db53fea5ff030c
-
SHA256
6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d
-
SHA512
fc0805c32d381f4ec0434443f44ac5ace557f96099dabc0c35cc16d21b0daf5665ba058019101eb8adfe4d769d3a3318c971e4b171a740eb533dfd9498e55d4d
-
SSDEEP
6144:k999eCEB+d9EItun+X461zhWVVDYrEfrzZOIvQoAdOoW1QHYdEPRdWtoyBu99:c5EganW4/Lrzzyp4dEPR0oyB
Malware Config
Signatures
-
Detect Neshta payload 46 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Windows\svchost.com family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe family_neshta C:\Windows\svchost.com family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE family_neshta C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Windows\svchost.com family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exesvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.compid process 844 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe 560 svchost.com 384 6319F4~1.EXE 1592 svchost.com 1892 6319F4~1.EXE 1648 svchost.com 1964 6319F4~1.EXE 280 svchost.com 1524 6319F4~1.EXE 1764 svchost.com 1676 6319F4~1.EXE 1560 svchost.com 992 6319F4~1.EXE 1728 svchost.com 948 6319F4~1.EXE 1584 svchost.com 1088 6319F4~1.EXE 1780 svchost.com 2020 6319F4~1.EXE 1040 svchost.com 900 6319F4~1.EXE 1940 svchost.com 1232 6319F4~1.EXE 1964 svchost.com 1144 6319F4~1.EXE 1632 svchost.com 1436 6319F4~1.EXE 1496 svchost.com 628 6319F4~1.EXE 1404 svchost.com 1732 6319F4~1.EXE 1452 svchost.com 1784 6319F4~1.EXE 1980 svchost.com 2000 6319F4~1.EXE 2028 svchost.com 468 6319F4~1.EXE 840 svchost.com 1928 6319F4~1.EXE 1888 svchost.com 560 6319F4~1.EXE 1780 svchost.com 2020 6319F4~1.EXE 532 svchost.com 1040 6319F4~1.EXE 1748 svchost.com 1892 6319F4~1.EXE 928 svchost.com 1964 6319F4~1.EXE 1836 svchost.com 1720 6319F4~1.EXE 1636 svchost.com 1496 6319F4~1.EXE 1488 svchost.com 1032 6319F4~1.EXE 1408 svchost.com 1464 6319F4~1.EXE 1736 svchost.com 2000 6319F4~1.EXE 1164 svchost.com 468 6319F4~1.EXE 692 svchost.com 528 6319F4~1.EXE 384 svchost.com -
Loads dropped DLL 64 IoCs
Processes:
6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.compid process 956 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe 956 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe 560 svchost.com 560 svchost.com 1592 svchost.com 1592 svchost.com 1648 svchost.com 1648 svchost.com 280 svchost.com 280 svchost.com 1764 svchost.com 1764 svchost.com 1560 svchost.com 1560 svchost.com 1728 svchost.com 1728 svchost.com 1584 svchost.com 1584 svchost.com 1780 svchost.com 1780 svchost.com 1040 svchost.com 1040 svchost.com 1940 svchost.com 1940 svchost.com 1964 svchost.com 1964 svchost.com 1632 svchost.com 1632 svchost.com 1496 svchost.com 1496 svchost.com 1404 svchost.com 1404 svchost.com 1452 svchost.com 1452 svchost.com 1980 svchost.com 1980 svchost.com 2028 svchost.com 2028 svchost.com 840 svchost.com 840 svchost.com 1888 svchost.com 1888 svchost.com 1780 svchost.com 1780 svchost.com 532 svchost.com 532 svchost.com 1748 svchost.com 1748 svchost.com 928 svchost.com 928 svchost.com 1836 svchost.com 1836 svchost.com 1636 svchost.com 1636 svchost.com 1488 svchost.com 1488 svchost.com 1408 svchost.com 1408 svchost.com 1736 svchost.com 1736 svchost.com 1164 svchost.com 1164 svchost.com 692 svchost.com 692 svchost.com -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exedescription ioc process File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe -
Drops file in Windows directory 64 IoCs
Processes:
svchost.comsvchost.com6319F4~1.EXE6319F4~1.EXE6319F4~1.EXEsvchost.comsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXE6319F4~1.EXEsvchost.comsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXE6319F4~1.EXE6319F4~1.EXEsvchost.comsvchost.com6319F4~1.EXEsvchost.comsvchost.comsvchost.comsvchost.com6319F4~1.EXE6319F4~1.EXE6319F4~1.EXEsvchost.com6319F4~1.EXE6319F4~1.EXE6319F4~1.EXEsvchost.comdescription ioc process File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 6319F4~1.EXE File opened for modification C:\Windows\directx.sys 6319F4~1.EXE File opened for modification C:\Windows\svchost.com 6319F4~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 6319F4~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com 6319F4~1.EXE File opened for modification C:\Windows\directx.sys 6319F4~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 6319F4~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 6319F4~1.EXE File opened for modification C:\Windows\directx.sys 6319F4~1.EXE File opened for modification C:\Windows\directx.sys 6319F4~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com 6319F4~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 6319F4~1.EXE File opened for modification C:\Windows\directx.sys 6319F4~1.EXE File opened for modification C:\Windows\directx.sys 6319F4~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 6319F4~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys 6319F4~1.EXE File opened for modification C:\Windows\directx.sys 6319F4~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exesvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEdescription pid process target process PID 956 wrote to memory of 844 956 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe PID 956 wrote to memory of 844 956 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe PID 956 wrote to memory of 844 956 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe PID 956 wrote to memory of 844 956 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe PID 844 wrote to memory of 560 844 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe svchost.com PID 844 wrote to memory of 560 844 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe svchost.com PID 844 wrote to memory of 560 844 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe svchost.com PID 844 wrote to memory of 560 844 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe svchost.com PID 560 wrote to memory of 384 560 svchost.com 6319F4~1.EXE PID 560 wrote to memory of 384 560 svchost.com 6319F4~1.EXE PID 560 wrote to memory of 384 560 svchost.com 6319F4~1.EXE PID 560 wrote to memory of 384 560 svchost.com 6319F4~1.EXE PID 384 wrote to memory of 1592 384 6319F4~1.EXE svchost.com PID 384 wrote to memory of 1592 384 6319F4~1.EXE svchost.com PID 384 wrote to memory of 1592 384 6319F4~1.EXE svchost.com PID 384 wrote to memory of 1592 384 6319F4~1.EXE svchost.com PID 1592 wrote to memory of 1892 1592 svchost.com 6319F4~1.EXE PID 1592 wrote to memory of 1892 1592 svchost.com 6319F4~1.EXE PID 1592 wrote to memory of 1892 1592 svchost.com 6319F4~1.EXE PID 1592 wrote to memory of 1892 1592 svchost.com 6319F4~1.EXE PID 1892 wrote to memory of 1648 1892 6319F4~1.EXE svchost.com PID 1892 wrote to memory of 1648 1892 6319F4~1.EXE svchost.com PID 1892 wrote to memory of 1648 1892 6319F4~1.EXE svchost.com PID 1892 wrote to memory of 1648 1892 6319F4~1.EXE svchost.com PID 1648 wrote to memory of 1964 1648 svchost.com 6319F4~1.EXE PID 1648 wrote to memory of 1964 1648 svchost.com 6319F4~1.EXE PID 1648 wrote to memory of 1964 1648 svchost.com 6319F4~1.EXE PID 1648 wrote to memory of 1964 1648 svchost.com 6319F4~1.EXE PID 1964 wrote to memory of 280 1964 6319F4~1.EXE svchost.com PID 1964 wrote to memory of 280 1964 6319F4~1.EXE svchost.com PID 1964 wrote to memory of 280 1964 6319F4~1.EXE svchost.com PID 1964 wrote to memory of 280 1964 6319F4~1.EXE svchost.com PID 280 wrote to memory of 1524 280 svchost.com 6319F4~1.EXE PID 280 wrote to memory of 1524 280 svchost.com 6319F4~1.EXE PID 280 wrote to memory of 1524 280 svchost.com 6319F4~1.EXE PID 280 wrote to memory of 1524 280 svchost.com 6319F4~1.EXE PID 1524 wrote to memory of 1764 1524 6319F4~1.EXE svchost.com PID 1524 wrote to memory of 1764 1524 6319F4~1.EXE svchost.com PID 1524 wrote to memory of 1764 1524 6319F4~1.EXE svchost.com PID 1524 wrote to memory of 1764 1524 6319F4~1.EXE svchost.com PID 1764 wrote to memory of 1676 1764 svchost.com 6319F4~1.EXE PID 1764 wrote to memory of 1676 1764 svchost.com 6319F4~1.EXE PID 1764 wrote to memory of 1676 1764 svchost.com 6319F4~1.EXE PID 1764 wrote to memory of 1676 1764 svchost.com 6319F4~1.EXE PID 1676 wrote to memory of 1560 1676 6319F4~1.EXE svchost.com PID 1676 wrote to memory of 1560 1676 6319F4~1.EXE svchost.com PID 1676 wrote to memory of 1560 1676 6319F4~1.EXE svchost.com PID 1676 wrote to memory of 1560 1676 6319F4~1.EXE svchost.com PID 1560 wrote to memory of 992 1560 svchost.com 6319F4~1.EXE PID 1560 wrote to memory of 992 1560 svchost.com 6319F4~1.EXE PID 1560 wrote to memory of 992 1560 svchost.com 6319F4~1.EXE PID 1560 wrote to memory of 992 1560 svchost.com 6319F4~1.EXE PID 992 wrote to memory of 1728 992 6319F4~1.EXE svchost.com PID 992 wrote to memory of 1728 992 6319F4~1.EXE svchost.com PID 992 wrote to memory of 1728 992 6319F4~1.EXE svchost.com PID 992 wrote to memory of 1728 992 6319F4~1.EXE svchost.com PID 1728 wrote to memory of 948 1728 svchost.com 6319F4~1.EXE PID 1728 wrote to memory of 948 1728 svchost.com 6319F4~1.EXE PID 1728 wrote to memory of 948 1728 svchost.com 6319F4~1.EXE PID 1728 wrote to memory of 948 1728 svchost.com 6319F4~1.EXE PID 948 wrote to memory of 1584 948 6319F4~1.EXE svchost.com PID 948 wrote to memory of 1584 948 6319F4~1.EXE svchost.com PID 948 wrote to memory of 1584 948 6319F4~1.EXE svchost.com PID 948 wrote to memory of 1584 948 6319F4~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe"C:\Users\Admin\AppData\Local\Temp\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:280 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE18⤵
- Executes dropped EXE
PID:1088 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE20⤵
- Executes dropped EXE
PID:2020 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE22⤵
- Executes dropped EXE
PID:900 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE24⤵
- Executes dropped EXE
PID:1232 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE26⤵
- Executes dropped EXE
PID:1144 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE28⤵
- Executes dropped EXE
PID:1436 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE30⤵
- Executes dropped EXE
PID:628 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE32⤵
- Executes dropped EXE
PID:1732 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE34⤵
- Executes dropped EXE
PID:1784 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE36⤵
- Executes dropped EXE
PID:2000 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE38⤵
- Executes dropped EXE
PID:468 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE40⤵
- Executes dropped EXE
PID:1928 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE42⤵
- Executes dropped EXE
PID:560 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE44⤵
- Executes dropped EXE
PID:2020 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE46⤵
- Executes dropped EXE
PID:1040 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE48⤵
- Executes dropped EXE
PID:1892 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:928 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE50⤵
- Executes dropped EXE
PID:1964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE52⤵
- Executes dropped EXE
PID:1720 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE54⤵
- Executes dropped EXE
PID:1496 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE56⤵
- Executes dropped EXE
PID:1032 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE58⤵
- Executes dropped EXE
PID:1464 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE60⤵
- Executes dropped EXE
PID:2000 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE62⤵
- Executes dropped EXE
PID:468 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:692 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE64⤵
- Executes dropped EXE
PID:528 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"65⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE66⤵PID:1828
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"67⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE68⤵PID:1780
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"69⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE70⤵PID:2012
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"71⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE72⤵PID:1132
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"73⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE74⤵PID:1388
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"75⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE76⤵PID:1120
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"77⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE78⤵PID:1920
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"79⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE80⤵PID:1416
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"81⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE82⤵PID:1732
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"83⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE84⤵PID:1952
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"85⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE86⤵PID:1608
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"87⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE88⤵PID:1884
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"89⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE90⤵PID:1928
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"91⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE92⤵PID:840
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"93⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE94⤵PID:1688
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"95⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE96⤵PID:1644
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"97⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE98⤵PID:1628
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"99⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE100⤵PID:1752
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"101⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE102⤵PID:1948
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"103⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE104⤵PID:1740
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"105⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE106⤵PID:1676
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"107⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE108⤵PID:1636
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"109⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE110⤵PID:1728
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"111⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE112⤵PID:1716
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"113⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE114⤵PID:1980
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"115⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE116⤵PID:468
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"117⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE118⤵PID:1556
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"119⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE120⤵PID:1652
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"121⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE122⤵PID:560
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"123⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE124⤵PID:428
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"125⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE126⤵PID:2012
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"127⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE128⤵PID:1940
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"129⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE130⤵PID:1492
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"131⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE132⤵PID:280
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"133⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE134⤵PID:1680
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"135⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE136⤵PID:1676
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"137⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE138⤵PID:1404
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"139⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE140⤵PID:616
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"141⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE142⤵PID:896
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"143⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE144⤵PID:948
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"145⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE146⤵PID:1584
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"147⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE148⤵PID:1088
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"149⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE150⤵PID:1652
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"151⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE152⤵PID:560
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"153⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE154⤵PID:428
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"155⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE156⤵PID:1748
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"157⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE158⤵
- Drops file in Windows directory
PID:1696 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"159⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE160⤵PID:1964
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"161⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE162⤵PID:1720
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"163⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE164⤵PID:1856
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"165⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE166⤵PID:1452
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"167⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE168⤵PID:1784
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"169⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE170⤵
- Drops file in Windows directory
PID:1716 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"171⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE172⤵PID:2036
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"173⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE174⤵PID:652
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"175⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE176⤵PID:692
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"177⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE178⤵PID:384
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"179⤵
- Drops file in Windows directory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE180⤵PID:1824
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"181⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE182⤵PID:2020
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"183⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE184⤵PID:1132
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"185⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE186⤵PID:1388
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"187⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE188⤵PID:1524
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"189⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE190⤵PID:1484
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"191⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE192⤵PID:1384
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"193⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE194⤵PID:1036
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"195⤵
- Drops file in Windows directory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE196⤵PID:700
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"197⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE198⤵PID:1608
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"199⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE200⤵PID:1980
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"201⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE202⤵PID:1976
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"203⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE204⤵PID:1544
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"205⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE206⤵PID:784
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"207⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE208⤵PID:1780
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"209⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE210⤵PID:900
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"211⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE212⤵PID:2012
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"213⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE214⤵PID:2044
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"215⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE216⤵PID:1388
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"217⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE218⤵PID:1964
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"219⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE220⤵PID:1840
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"221⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE222⤵PID:1384
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"223⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE224⤵PID:1036
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"225⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE226⤵PID:700
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"227⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE228⤵PID:1608
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"229⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE230⤵PID:1980
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"231⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE232⤵PID:1976
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"233⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE234⤵PID:1104
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"235⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE236⤵PID:1212
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"237⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE238⤵PID:1592
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"239⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE240⤵PID:1640
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"241⤵PID:532
-