Analysis
-
max time kernel
190s -
max time network
214s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 08:04
Behavioral task
behavioral1
Sample
6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe
Resource
win10v2004-20221111-en
General
-
Target
6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe
-
Size
536KB
-
MD5
3e34aa903d09bd824af20d8e7d16248d
-
SHA1
c17b17c0dad5afb6a2b2348be4db53fea5ff030c
-
SHA256
6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d
-
SHA512
fc0805c32d381f4ec0434443f44ac5ace557f96099dabc0c35cc16d21b0daf5665ba058019101eb8adfe4d769d3a3318c971e4b171a740eb533dfd9498e55d4d
-
SSDEEP
6144:k999eCEB+d9EItun+X461zhWVVDYrEfrzZOIvQoAdOoW1QHYdEPRdWtoyBu99:c5EganW4/Lrzzyp4dEPR0oyB
Malware Config
Signatures
-
Detect Neshta payload 35 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Windows\svchost.com family_neshta C:\odt\OFFICE~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe family_neshta C:\Windows\svchost.com family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exesvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.compid process 3464 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe 2156 svchost.com 4532 6319F4~1.EXE 3644 svchost.com 3472 6319F4~1.EXE 2476 svchost.com 1264 6319F4~1.EXE 4360 svchost.com 2652 6319F4~1.EXE 4932 svchost.com 2852 6319F4~1.EXE 3664 svchost.com 4756 6319F4~1.EXE 3424 svchost.com 4432 6319F4~1.EXE 3116 svchost.com 4176 6319F4~1.EXE 4344 svchost.com 2532 6319F4~1.EXE 5064 svchost.com 2692 6319F4~1.EXE 4212 svchost.com 3552 6319F4~1.EXE 2276 svchost.com 1440 6319F4~1.EXE 4408 svchost.com 1672 6319F4~1.EXE 3708 svchost.com 1152 6319F4~1.EXE 4780 svchost.com 3964 6319F4~1.EXE 4792 svchost.com 4712 6319F4~1.EXE 1212 svchost.com 1668 6319F4~1.EXE 1168 svchost.com 1648 6319F4~1.EXE 4008 svchost.com 4028 6319F4~1.EXE 4952 svchost.com 3188 6319F4~1.EXE 1560 svchost.com 940 6319F4~1.EXE 3668 svchost.com 3468 6319F4~1.EXE 1340 svchost.com 3644 6319F4~1.EXE 3768 svchost.com 5100 6319F4~1.EXE 2160 svchost.com 1744 6319F4~1.EXE 4360 svchost.com 1876 6319F4~1.EXE 1520 svchost.com 2640 6319F4~1.EXE 2852 svchost.com 2864 6319F4~1.EXE 5080 svchost.com 5076 6319F4~1.EXE 4340 svchost.com 1008 6319F4~1.EXE 4300 svchost.com 2492 6319F4~1.EXE 3828 svchost.com -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXEdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6319F4~1.EXE -
Drops file in Program Files directory 4 IoCs
Processes:
6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exedescription ioc process File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe -
Drops file in Windows directory 64 IoCs
Processes:
svchost.com6319F4~1.EXEsvchost.comsvchost.comsvchost.comsvchost.com6319F4~1.EXE6319F4~1.EXE6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.comsvchost.comsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXE6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXE6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXE6319F4~1.EXEsvchost.comsvchost.com6319F4~1.EXE6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.comsvchost.comsvchost.comsvchost.com6319F4~1.EXE6319F4~1.EXE6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.comsvchost.com6319F4~1.EXEsvchost.comsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com6319F4~1.EXEdescription ioc process File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 6319F4~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 6319F4~1.EXE File opened for modification C:\Windows\svchost.com 6319F4~1.EXE File opened for modification C:\Windows\svchost.com 6319F4~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 6319F4~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 6319F4~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 6319F4~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 6319F4~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 6319F4~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 6319F4~1.EXE File opened for modification C:\Windows\directx.sys 6319F4~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 6319F4~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 6319F4~1.EXE File opened for modification C:\Windows\svchost.com 6319F4~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 6319F4~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 6319F4~1.EXE File opened for modification C:\Windows\svchost.com 6319F4~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 6319F4~1.EXE File opened for modification C:\Windows\svchost.com 6319F4~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 6319F4~1.EXE File opened for modification C:\Windows\svchost.com 6319F4~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 6319F4~1.EXE File opened for modification C:\Windows\svchost.com 6319F4~1.EXE File opened for modification C:\Windows\directx.sys 6319F4~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 6319F4~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 6319F4~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 6319F4~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 6319F4~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 6319F4~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
Processes:
6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXE6319F4~1.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 6319F4~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exesvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEsvchost.com6319F4~1.EXEdescription pid process target process PID 1372 wrote to memory of 3464 1372 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe PID 1372 wrote to memory of 3464 1372 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe PID 1372 wrote to memory of 3464 1372 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe PID 3464 wrote to memory of 2156 3464 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe svchost.com PID 3464 wrote to memory of 2156 3464 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe svchost.com PID 3464 wrote to memory of 2156 3464 6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe svchost.com PID 2156 wrote to memory of 4532 2156 svchost.com 6319F4~1.EXE PID 2156 wrote to memory of 4532 2156 svchost.com 6319F4~1.EXE PID 2156 wrote to memory of 4532 2156 svchost.com 6319F4~1.EXE PID 4532 wrote to memory of 3644 4532 6319F4~1.EXE svchost.com PID 4532 wrote to memory of 3644 4532 6319F4~1.EXE svchost.com PID 4532 wrote to memory of 3644 4532 6319F4~1.EXE svchost.com PID 3644 wrote to memory of 3472 3644 svchost.com 6319F4~1.EXE PID 3644 wrote to memory of 3472 3644 svchost.com 6319F4~1.EXE PID 3644 wrote to memory of 3472 3644 svchost.com 6319F4~1.EXE PID 3472 wrote to memory of 2476 3472 6319F4~1.EXE svchost.com PID 3472 wrote to memory of 2476 3472 6319F4~1.EXE svchost.com PID 3472 wrote to memory of 2476 3472 6319F4~1.EXE svchost.com PID 2476 wrote to memory of 1264 2476 svchost.com 6319F4~1.EXE PID 2476 wrote to memory of 1264 2476 svchost.com 6319F4~1.EXE PID 2476 wrote to memory of 1264 2476 svchost.com 6319F4~1.EXE PID 1264 wrote to memory of 4360 1264 6319F4~1.EXE svchost.com PID 1264 wrote to memory of 4360 1264 6319F4~1.EXE svchost.com PID 1264 wrote to memory of 4360 1264 6319F4~1.EXE svchost.com PID 4360 wrote to memory of 2652 4360 svchost.com 6319F4~1.EXE PID 4360 wrote to memory of 2652 4360 svchost.com 6319F4~1.EXE PID 4360 wrote to memory of 2652 4360 svchost.com 6319F4~1.EXE PID 2652 wrote to memory of 4932 2652 6319F4~1.EXE svchost.com PID 2652 wrote to memory of 4932 2652 6319F4~1.EXE svchost.com PID 2652 wrote to memory of 4932 2652 6319F4~1.EXE svchost.com PID 4932 wrote to memory of 2852 4932 svchost.com 6319F4~1.EXE PID 4932 wrote to memory of 2852 4932 svchost.com 6319F4~1.EXE PID 4932 wrote to memory of 2852 4932 svchost.com 6319F4~1.EXE PID 2852 wrote to memory of 3664 2852 6319F4~1.EXE svchost.com PID 2852 wrote to memory of 3664 2852 6319F4~1.EXE svchost.com PID 2852 wrote to memory of 3664 2852 6319F4~1.EXE svchost.com PID 3664 wrote to memory of 4756 3664 svchost.com 6319F4~1.EXE PID 3664 wrote to memory of 4756 3664 svchost.com 6319F4~1.EXE PID 3664 wrote to memory of 4756 3664 svchost.com 6319F4~1.EXE PID 4756 wrote to memory of 3424 4756 6319F4~1.EXE svchost.com PID 4756 wrote to memory of 3424 4756 6319F4~1.EXE svchost.com PID 4756 wrote to memory of 3424 4756 6319F4~1.EXE svchost.com PID 3424 wrote to memory of 4432 3424 svchost.com 6319F4~1.EXE PID 3424 wrote to memory of 4432 3424 svchost.com 6319F4~1.EXE PID 3424 wrote to memory of 4432 3424 svchost.com 6319F4~1.EXE PID 4432 wrote to memory of 3116 4432 6319F4~1.EXE svchost.com PID 4432 wrote to memory of 3116 4432 6319F4~1.EXE svchost.com PID 4432 wrote to memory of 3116 4432 6319F4~1.EXE svchost.com PID 3116 wrote to memory of 4176 3116 svchost.com 6319F4~1.EXE PID 3116 wrote to memory of 4176 3116 svchost.com 6319F4~1.EXE PID 3116 wrote to memory of 4176 3116 svchost.com 6319F4~1.EXE PID 4176 wrote to memory of 4344 4176 6319F4~1.EXE svchost.com PID 4176 wrote to memory of 4344 4176 6319F4~1.EXE svchost.com PID 4176 wrote to memory of 4344 4176 6319F4~1.EXE svchost.com PID 4344 wrote to memory of 2532 4344 svchost.com 6319F4~1.EXE PID 4344 wrote to memory of 2532 4344 svchost.com 6319F4~1.EXE PID 4344 wrote to memory of 2532 4344 svchost.com 6319F4~1.EXE PID 2532 wrote to memory of 5064 2532 6319F4~1.EXE svchost.com PID 2532 wrote to memory of 5064 2532 6319F4~1.EXE svchost.com PID 2532 wrote to memory of 5064 2532 6319F4~1.EXE svchost.com PID 5064 wrote to memory of 2692 5064 svchost.com 6319F4~1.EXE PID 5064 wrote to memory of 2692 5064 svchost.com 6319F4~1.EXE PID 5064 wrote to memory of 2692 5064 svchost.com 6319F4~1.EXE PID 2692 wrote to memory of 4212 2692 6319F4~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe"C:\Users\Admin\AppData\Local\Temp\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\6319f48483e5d3ad1acb1efda81d0f6b30ff528b9eee623e8f3a0f8fc5bd321d.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE10⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE18⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE22⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"23⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE24⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3552 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"25⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE26⤵
- Executes dropped EXE
PID:1440 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"27⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE28⤵
- Executes dropped EXE
PID:1672 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"29⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE30⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1152 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"31⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE32⤵
- Executes dropped EXE
PID:3964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"33⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE34⤵
- Executes dropped EXE
- Modifies registry class
PID:4712 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"35⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE36⤵
- Executes dropped EXE
- Checks computer location settings
PID:1668 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"37⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE38⤵
- Executes dropped EXE
PID:1648 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"39⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE40⤵
- Executes dropped EXE
PID:4028 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"41⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE42⤵
- Executes dropped EXE
- Modifies registry class
PID:3188 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"43⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE44⤵
- Executes dropped EXE
PID:940 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"45⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE46⤵
- Executes dropped EXE
- Checks computer location settings
PID:3468 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"47⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE48⤵
- Executes dropped EXE
PID:3644 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"49⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE50⤵
- Executes dropped EXE
PID:5100 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"51⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE52⤵
- Executes dropped EXE
PID:1744 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"53⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE54⤵
- Executes dropped EXE
- Checks computer location settings
PID:1876 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"55⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE56⤵
- Executes dropped EXE
- Checks computer location settings
PID:2640 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"57⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE58⤵
- Executes dropped EXE
PID:2864 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"59⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE60⤵
- Executes dropped EXE
PID:5076 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"61⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE62⤵
- Executes dropped EXE
- Modifies registry class
PID:1008 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"63⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE64⤵
- Executes dropped EXE
PID:2492 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"65⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE66⤵PID:4412
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"67⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE68⤵
- Modifies registry class
PID:2696 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"69⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE70⤵PID:1328
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"71⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE72⤵PID:2620
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"73⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE74⤵PID:1936
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"75⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE76⤵
- Drops file in Windows directory
PID:1320 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"77⤵
- Drops file in Windows directory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE78⤵
- Drops file in Windows directory
PID:1468 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"79⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE80⤵PID:4772
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"81⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE82⤵
- Modifies registry class
PID:3748 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"83⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE84⤵
- Checks computer location settings
- Modifies registry class
PID:5104 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"85⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE86⤵
- Modifies registry class
PID:2700 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"87⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE88⤵
- Checks computer location settings
PID:4008 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"89⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE90⤵
- Drops file in Windows directory
PID:3564 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"91⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE92⤵PID:3328
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"93⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE94⤵PID:1268
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"95⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE96⤵
- Modifies registry class
PID:3452 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"97⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE98⤵PID:4900
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"99⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE100⤵PID:4052
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"101⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE102⤵
- Modifies registry class
PID:1264 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"103⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE104⤵PID:4360
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"105⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE106⤵PID:4932
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"107⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE108⤵PID:2732
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"109⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE110⤵PID:3232
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"111⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE112⤵PID:1064
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"113⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE114⤵PID:1292
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"115⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE116⤵PID:2052
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"117⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE118⤵PID:3432
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"119⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE120⤵
- Modifies registry class
PID:4524 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"121⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE122⤵PID:4272
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"123⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE124⤵
- Checks computer location settings
- Modifies registry class
PID:3300 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"125⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE126⤵PID:1672
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"127⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE76⤵
- Checks computer location settings
PID:1396 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"77⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE78⤵PID:1856
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"79⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE80⤵PID:4840
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"81⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE82⤵PID:1768
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"83⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE84⤵PID:492
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"85⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE86⤵PID:3324
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"87⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE88⤵PID:3060
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"89⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE90⤵
- Checks computer location settings
PID:4548 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"91⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE92⤵PID:1788
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"93⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE94⤵PID:1456
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"95⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE96⤵
- Modifies registry class
PID:772 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"97⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE98⤵
- Checks computer location settings
PID:5048 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"99⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE100⤵
- Modifies registry class
PID:1864 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"101⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE102⤵PID:4592
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"103⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE104⤵PID:4384
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"105⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE106⤵PID:4688
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"107⤵
- Drops file in Windows directory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE108⤵PID:4732
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"109⤵
- Drops file in Windows directory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE110⤵
- Checks computer location settings
- Modifies registry class
PID:2052 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"111⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE112⤵
- Checks computer location settings
- Modifies registry class
PID:4964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"113⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE114⤵
- Checks computer location settings
PID:1420 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"115⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE116⤵PID:1440
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"117⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE118⤵
- Checks computer location settings
PID:364 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"119⤵
- Drops file in Windows directory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE120⤵
- Checks computer location settings
PID:2716 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"121⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE122⤵PID:2180
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"123⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE124⤵PID:1384
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"125⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE126⤵PID:4760
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"127⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE128⤵PID:4008
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"129⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE130⤵PID:4004
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"131⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE132⤵PID:3564
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"133⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE134⤵PID:3820
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"135⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE136⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
PID:1536 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"137⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE138⤵PID:3284
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"139⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE140⤵PID:372
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"141⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE142⤵PID:4924
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"143⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE144⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
PID:1088 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"145⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE146⤵
- Checks computer location settings
PID:2788 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"147⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE148⤵
- Checks computer location settings
PID:1436 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"149⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE150⤵PID:4420
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"151⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE152⤵PID:1892
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"153⤵
- Drops file in Windows directory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE154⤵PID:3272
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"155⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE156⤵PID:1652
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"157⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE158⤵PID:1992
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"159⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE160⤵PID:4408
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"161⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE162⤵PID:804
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"163⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE164⤵PID:4316
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"165⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE166⤵
- Checks computer location settings
- Drops file in Windows directory
PID:4616 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"167⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE168⤵PID:1168
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"169⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE170⤵
- Modifies registry class
PID:2704 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"171⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE172⤵
- Modifies registry class
PID:492 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"173⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE174⤵PID:4000
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"175⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE176⤵
- Checks computer location settings
PID:3188 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"177⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE178⤵
- Checks computer location settings
PID:1356 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"179⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE180⤵PID:3772
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"181⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE182⤵PID:3472
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"183⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE184⤵PID:4044
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"185⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE186⤵PID:1772
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"187⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE188⤵
- Drops file in Windows directory
PID:3396 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"189⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE190⤵PID:2640
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"191⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE192⤵
- Modifies registry class
PID:3316 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"193⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE194⤵
- Checks computer location settings
PID:1436 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"195⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE196⤵
- Drops file in Windows directory
PID:4784 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"197⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE198⤵PID:1892
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"199⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE200⤵PID:3272
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"201⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE202⤵
- Checks computer location settings
PID:1652 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"203⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE204⤵
- Modifies registry class
PID:1448 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"205⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE206⤵
- Checks computer location settings
- Modifies registry class
PID:4408 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"207⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE208⤵PID:804
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"209⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE210⤵PID:4316
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"211⤵
- Drops file in Windows directory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE212⤵PID:1644
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"213⤵
- Drops file in Windows directory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE214⤵PID:648
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"215⤵
- Drops file in Windows directory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE216⤵PID:4760
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"217⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE218⤵
- Modifies registry class
PID:1012 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"219⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE220⤵PID:4884
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"221⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE222⤵PID:3060
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"223⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE224⤵
- Modifies registry class
PID:4548 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"225⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE226⤵PID:3468
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"227⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE228⤵PID:4820
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"229⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE230⤵
- Checks computer location settings
- Modifies registry class
PID:5060 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"231⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE232⤵PID:2300
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"233⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE234⤵
- Checks computer location settings
- Modifies registry class
PID:4932 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"235⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE236⤵PID:4780
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"237⤵
- Drops file in Windows directory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE238⤵PID:1192
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"239⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE240⤵
- Modifies registry class
PID:4968 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6319F4~1.EXE"241⤵PID:2532
-