Analysis
-
max time kernel
172s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 08:05
Behavioral task
behavioral1
Sample
392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe
Resource
win10v2004-20221111-en
General
-
Target
392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe
-
Size
178KB
-
MD5
e6b16e3deb1e7702e4f9c4ac143b4c43
-
SHA1
464c1e3b47c24a779a0c4b00bb8c4b0e63ee839f
-
SHA256
392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52
-
SHA512
d658fe2154bf69af2bb3e4cbd61abbb195e5f789d004ee93e781e3d21a64c394e63d045be7f03d9bdd500e8838f66ebac7e5cb02a75e5dd128c3dccc4079a37b
-
SSDEEP
1536:JxqjQ+P04wsmJCiDRI2zoFmQDrA0qxs267MmgKIcBbOxqjQ+P04wsmJCoOxqjQ+9:sr85CipzoFm+M9sr85CKr85C
Malware Config
Signatures
-
Detect Neshta payload 46 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exesvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.compid process 592 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe 268 svchost.com 900 392ECE~1.EXE 688 svchost.com 1244 392ECE~1.EXE 1108 svchost.com 1008 392ECE~1.EXE 704 svchost.com 1360 392ECE~1.EXE 364 svchost.com 1660 392ECE~1.EXE 544 svchost.com 1300 392ECE~1.EXE 1856 svchost.com 2024 392ECE~1.EXE 1580 svchost.com 1720 392ECE~1.EXE 1900 svchost.com 2020 392ECE~1.EXE 1372 svchost.com 1692 392ECE~1.EXE 328 svchost.com 1244 392ECE~1.EXE 1464 svchost.com 1684 392ECE~1.EXE 1292 svchost.com 1144 392ECE~1.EXE 964 svchost.com 1492 392ECE~1.EXE 824 svchost.com 1064 392ECE~1.EXE 1904 svchost.com 1756 392ECE~1.EXE 544 svchost.com 1308 392ECE~1.EXE 2012 svchost.com 2004 392ECE~1.EXE 1608 svchost.com 1768 392ECE~1.EXE 576 svchost.com 1748 392ECE~1.EXE 1800 svchost.com 1164 392ECE~1.EXE 2020 svchost.com 976 392ECE~1.EXE 1532 svchost.com 1732 392ECE~1.EXE 1244 svchost.com 1052 392ECE~1.EXE 1256 svchost.com 2036 392ECE~1.EXE 820 svchost.com 704 392ECE~1.EXE 1724 svchost.com 1492 392ECE~1.EXE 1928 svchost.com 1028 392ECE~1.EXE 1568 svchost.com 1804 392ECE~1.EXE 544 svchost.com 1308 392ECE~1.EXE 2012 svchost.com 2004 392ECE~1.EXE 1764 svchost.com -
Loads dropped DLL 64 IoCs
Processes:
392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.compid process 2040 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe 2040 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe 268 svchost.com 268 svchost.com 688 svchost.com 688 svchost.com 1108 svchost.com 1108 svchost.com 704 svchost.com 704 svchost.com 364 svchost.com 364 svchost.com 544 svchost.com 544 svchost.com 1856 svchost.com 1856 svchost.com 1580 svchost.com 1580 svchost.com 1900 svchost.com 1900 svchost.com 1372 svchost.com 1372 svchost.com 328 svchost.com 328 svchost.com 1464 svchost.com 1464 svchost.com 1292 svchost.com 1292 svchost.com 964 svchost.com 964 svchost.com 824 svchost.com 824 svchost.com 1904 svchost.com 1904 svchost.com 544 svchost.com 544 svchost.com 2012 svchost.com 2012 svchost.com 1608 svchost.com 1608 svchost.com 576 svchost.com 576 svchost.com 1800 svchost.com 1800 svchost.com 2020 svchost.com 2020 svchost.com 1532 svchost.com 1532 svchost.com 1244 svchost.com 1244 svchost.com 1256 svchost.com 1256 svchost.com 820 svchost.com 820 svchost.com 1724 svchost.com 1724 svchost.com 1928 svchost.com 1928 svchost.com 1568 svchost.com 1568 svchost.com 544 svchost.com 544 svchost.com 2012 svchost.com 2012 svchost.com -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exedescription ioc process File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe -
Drops file in Windows directory 64 IoCs
Processes:
svchost.comsvchost.comsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXE392ECE~1.EXE392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exesvchost.com392ECE~1.EXE392ECE~1.EXE392ECE~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com392ECE~1.EXE392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.comsvchost.com392ECE~1.EXE392ECE~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com392ECE~1.EXE392ECE~1.EXEsvchost.comsvchost.comdescription ioc process File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 392ECE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 392ECE~1.EXE File opened for modification C:\Windows\directx.sys 392ECE~1.EXE File opened for modification C:\Windows\svchost.com 392ECE~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys 392ECE~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 392ECE~1.EXE File opened for modification C:\Windows\svchost.com 392ECE~1.EXE File opened for modification C:\Windows\svchost.com 392ECE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 392ECE~1.EXE File opened for modification C:\Windows\directx.sys 392ECE~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 392ECE~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 392ECE~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys 392ECE~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com 392ECE~1.EXE File opened for modification C:\Windows\svchost.com 392ECE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exesvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEsvchost.com392ECE~1.EXEdescription pid process target process PID 2040 wrote to memory of 592 2040 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe PID 2040 wrote to memory of 592 2040 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe PID 2040 wrote to memory of 592 2040 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe PID 2040 wrote to memory of 592 2040 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe PID 592 wrote to memory of 268 592 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe svchost.com PID 592 wrote to memory of 268 592 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe svchost.com PID 592 wrote to memory of 268 592 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe svchost.com PID 592 wrote to memory of 268 592 392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe svchost.com PID 268 wrote to memory of 900 268 svchost.com 392ECE~1.EXE PID 268 wrote to memory of 900 268 svchost.com 392ECE~1.EXE PID 268 wrote to memory of 900 268 svchost.com 392ECE~1.EXE PID 268 wrote to memory of 900 268 svchost.com 392ECE~1.EXE PID 900 wrote to memory of 688 900 392ECE~1.EXE svchost.com PID 900 wrote to memory of 688 900 392ECE~1.EXE svchost.com PID 900 wrote to memory of 688 900 392ECE~1.EXE svchost.com PID 900 wrote to memory of 688 900 392ECE~1.EXE svchost.com PID 688 wrote to memory of 1244 688 svchost.com 392ECE~1.EXE PID 688 wrote to memory of 1244 688 svchost.com 392ECE~1.EXE PID 688 wrote to memory of 1244 688 svchost.com 392ECE~1.EXE PID 688 wrote to memory of 1244 688 svchost.com 392ECE~1.EXE PID 1244 wrote to memory of 1108 1244 392ECE~1.EXE svchost.com PID 1244 wrote to memory of 1108 1244 392ECE~1.EXE svchost.com PID 1244 wrote to memory of 1108 1244 392ECE~1.EXE svchost.com PID 1244 wrote to memory of 1108 1244 392ECE~1.EXE svchost.com PID 1108 wrote to memory of 1008 1108 svchost.com 392ECE~1.EXE PID 1108 wrote to memory of 1008 1108 svchost.com 392ECE~1.EXE PID 1108 wrote to memory of 1008 1108 svchost.com 392ECE~1.EXE PID 1108 wrote to memory of 1008 1108 svchost.com 392ECE~1.EXE PID 1008 wrote to memory of 704 1008 392ECE~1.EXE svchost.com PID 1008 wrote to memory of 704 1008 392ECE~1.EXE svchost.com PID 1008 wrote to memory of 704 1008 392ECE~1.EXE svchost.com PID 1008 wrote to memory of 704 1008 392ECE~1.EXE svchost.com PID 704 wrote to memory of 1360 704 svchost.com 392ECE~1.EXE PID 704 wrote to memory of 1360 704 svchost.com 392ECE~1.EXE PID 704 wrote to memory of 1360 704 svchost.com 392ECE~1.EXE PID 704 wrote to memory of 1360 704 svchost.com 392ECE~1.EXE PID 1360 wrote to memory of 364 1360 392ECE~1.EXE svchost.com PID 1360 wrote to memory of 364 1360 392ECE~1.EXE svchost.com PID 1360 wrote to memory of 364 1360 392ECE~1.EXE svchost.com PID 1360 wrote to memory of 364 1360 392ECE~1.EXE svchost.com PID 364 wrote to memory of 1660 364 svchost.com 392ECE~1.EXE PID 364 wrote to memory of 1660 364 svchost.com 392ECE~1.EXE PID 364 wrote to memory of 1660 364 svchost.com 392ECE~1.EXE PID 364 wrote to memory of 1660 364 svchost.com 392ECE~1.EXE PID 1660 wrote to memory of 544 1660 392ECE~1.EXE svchost.com PID 1660 wrote to memory of 544 1660 392ECE~1.EXE svchost.com PID 1660 wrote to memory of 544 1660 392ECE~1.EXE svchost.com PID 1660 wrote to memory of 544 1660 392ECE~1.EXE svchost.com PID 544 wrote to memory of 1300 544 svchost.com 392ECE~1.EXE PID 544 wrote to memory of 1300 544 svchost.com 392ECE~1.EXE PID 544 wrote to memory of 1300 544 svchost.com 392ECE~1.EXE PID 544 wrote to memory of 1300 544 svchost.com 392ECE~1.EXE PID 1300 wrote to memory of 1856 1300 392ECE~1.EXE svchost.com PID 1300 wrote to memory of 1856 1300 392ECE~1.EXE svchost.com PID 1300 wrote to memory of 1856 1300 392ECE~1.EXE svchost.com PID 1300 wrote to memory of 1856 1300 392ECE~1.EXE svchost.com PID 1856 wrote to memory of 2024 1856 svchost.com 392ECE~1.EXE PID 1856 wrote to memory of 2024 1856 svchost.com 392ECE~1.EXE PID 1856 wrote to memory of 2024 1856 svchost.com 392ECE~1.EXE PID 1856 wrote to memory of 2024 1856 svchost.com 392ECE~1.EXE PID 2024 wrote to memory of 1580 2024 392ECE~1.EXE svchost.com PID 2024 wrote to memory of 1580 2024 392ECE~1.EXE svchost.com PID 2024 wrote to memory of 1580 2024 392ECE~1.EXE svchost.com PID 2024 wrote to memory of 1580 2024 392ECE~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe"C:\Users\Admin\AppData\Local\Temp\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\392ece1c10a31499588ce2557f3c601c44183cc3b23ab33e07fd26da9cfffb52.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE18⤵
- Executes dropped EXE
PID:1720 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE20⤵
- Executes dropped EXE
PID:2020 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE22⤵
- Executes dropped EXE
PID:1692 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE24⤵
- Executes dropped EXE
PID:1244 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE26⤵
- Executes dropped EXE
PID:1684 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE28⤵
- Executes dropped EXE
PID:1144 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:964 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE30⤵
- Executes dropped EXE
PID:1492 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:824 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE32⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1064 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE34⤵
- Executes dropped EXE
PID:1756 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:544 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE36⤵
- Executes dropped EXE
PID:1308 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE38⤵
- Executes dropped EXE
PID:2004 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE40⤵
- Executes dropped EXE
PID:1768 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE42⤵
- Executes dropped EXE
PID:1748 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE44⤵
- Executes dropped EXE
PID:1164 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE46⤵
- Executes dropped EXE
PID:976 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE48⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1732 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE50⤵
- Executes dropped EXE
PID:1052 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE52⤵
- Executes dropped EXE
PID:2036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:820 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE54⤵
- Executes dropped EXE
PID:704 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE56⤵
- Executes dropped EXE
PID:1492 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE58⤵
- Executes dropped EXE
PID:1028 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE60⤵
- Executes dropped EXE
PID:1804 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:544 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE62⤵
- Executes dropped EXE
PID:1308 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE64⤵
- Executes dropped EXE
PID:2004 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"65⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE66⤵PID:1768
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"67⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE68⤵PID:932
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"69⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE70⤵PID:572
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"71⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE72⤵PID:1372
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"73⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE74⤵PID:1668
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"75⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE76⤵PID:1108
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"77⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE78⤵PID:1096
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"79⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE80⤵PID:1256
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"81⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE82⤵PID:820
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"83⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE84⤵PID:1660
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"85⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE86⤵PID:1640
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"87⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE88⤵PID:1296
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"89⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE90⤵PID:1100
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"91⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE92⤵PID:1276
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"93⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE94⤵PID:2012
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"95⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE96⤵PID:1508
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"97⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE98⤵PID:1392
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"99⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE100⤵PID:1564
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"101⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE102⤵PID:1372
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"103⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE104⤵PID:1732
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"105⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE106⤵PID:688
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"107⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE46⤵PID:1336
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"47⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE48⤵PID:1692
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"49⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE50⤵
- Drops file in Windows directory
PID:1520 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"51⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE52⤵PID:1372
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"53⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE54⤵PID:1240
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"55⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE56⤵PID:1052
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"57⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE58⤵PID:1032
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"59⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE60⤵PID:1680
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"61⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE62⤵PID:1036
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"63⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE64⤵PID:824
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"65⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE66⤵PID:1296
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"67⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE68⤵PID:864
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"69⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE70⤵PID:1752
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"71⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE72⤵PID:1644
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"73⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE74⤵PID:944
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"75⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE76⤵PID:1508
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"77⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE78⤵PID:1548
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"79⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE80⤵PID:560
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"81⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE82⤵PID:988
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"83⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE84⤵PID:636
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"85⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE86⤵PID:1960
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"87⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE88⤵PID:608
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"89⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE90⤵
- Drops file in Windows directory
PID:1344 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"91⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE92⤵PID:704
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"93⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE94⤵PID:1660
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"95⤵
- Drops file in Windows directory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE96⤵PID:996
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"97⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE98⤵PID:1448
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"99⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE100⤵PID:544
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"101⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE102⤵PID:1804
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"103⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE104⤵PID:1304
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"105⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE106⤵PID:1392
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"107⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE108⤵PID:1564
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"109⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE110⤵PID:976
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"111⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE112⤵PID:1544
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"113⤵
- Drops file in Windows directory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE114⤵PID:1732
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"115⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE116⤵PID:2036
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"117⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE118⤵PID:1952
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"119⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE120⤵PID:1916
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"121⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE122⤵PID:1036
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"123⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE124⤵PID:1928
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"125⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE126⤵PID:1904
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"127⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE128⤵PID:1400
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"129⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE130⤵PID:1648
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"131⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE132⤵PID:1644
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"133⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE134⤵PID:1156
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"135⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE136⤵PID:572
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"137⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE138⤵PID:900
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"139⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE140⤵PID:1900
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"141⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE142⤵PID:1372
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"143⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE144⤵PID:1460
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"145⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE146⤵PID:1960
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"147⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE148⤵PID:1052
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"149⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE150⤵PID:964
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"151⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE152⤵PID:1724
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"153⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE154⤵PID:1852
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"155⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE156⤵PID:1296
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"157⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE158⤵PID:1580
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"159⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE160⤵PID:1832
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"161⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE162⤵PID:1276
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"163⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE164⤵PID:944
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"165⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE166⤵PID:1688
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"167⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE168⤵PID:892
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"169⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE170⤵PID:1548
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"171⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE172⤵PID:1696
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"173⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE174⤵PID:328
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"175⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE176⤵PID:2036
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"177⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE178⤵PID:628
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"179⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE180⤵PID:1952
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"181⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE182⤵PID:1064
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"183⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE184⤵PID:704
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"185⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE127⤵PID:2024
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"128⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE129⤵PID:1308
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"130⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE131⤵PID:1312
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"132⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE133⤵PID:1484
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"134⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE135⤵PID:1676
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"136⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE137⤵PID:948
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"138⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE139⤵PID:560
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"140⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE141⤵PID:792
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"142⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE143⤵PID:1736
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"144⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE145⤵
- Drops file in Windows directory
PID:1112 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"146⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE147⤵PID:1240
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"148⤵
- Drops file in Windows directory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE149⤵PID:1540
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"150⤵PID:284
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE151⤵PID:772
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"152⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE153⤵PID:1764
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"154⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE155⤵
- Drops file in Windows directory
PID:1660 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"156⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE157⤵PID:1904
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"158⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE159⤵
- Drops file in Windows directory
PID:1920 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"160⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE161⤵PID:1648
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"162⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE163⤵PID:684
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"164⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE165⤵PID:944
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"166⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE167⤵PID:932
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"168⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE169⤵PID:924
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"170⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE171⤵PID:1532
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"172⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE173⤵PID:1584
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"174⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE175⤵PID:112
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"176⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE177⤵PID:608
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"178⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE179⤵PID:1256
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"180⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE181⤵
- Drops file in Windows directory
PID:964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"182⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE183⤵PID:2012
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"184⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE185⤵PID:1928
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"186⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE187⤵
- Drops file in Windows directory
PID:1728 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"188⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE189⤵PID:1948
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"190⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE191⤵PID:1368
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"192⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE193⤵PID:1484
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"194⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE195⤵PID:1508
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"196⤵
- Drops file in Windows directory
PID:580 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE197⤵PID:900
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"198⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE199⤵PID:1340
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"200⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE201⤵PID:792
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"202⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE203⤵PID:1736
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"204⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE205⤵PID:328
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"206⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE207⤵PID:552
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"208⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE209⤵PID:1380
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"210⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE211⤵PID:1344
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"212⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE213⤵PID:1988
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"214⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE215⤵PID:1028
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"216⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE217⤵PID:1956
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"218⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE219⤵PID:864
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"220⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE221⤵PID:1276
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"222⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE223⤵PID:576
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"224⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE225⤵PID:684
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"226⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE227⤵PID:948
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"228⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE229⤵PID:560
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"230⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE231⤵PID:1372
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"232⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE233⤵PID:1684
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"234⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE235⤵PID:1460
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"236⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE237⤵
- Drops file in Windows directory
PID:968 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"238⤵
- Drops file in Windows directory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE239⤵PID:1916
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE"240⤵PID:284
-
C:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\392ECE~1.EXE241⤵PID:1364
-