Analysis
-
max time kernel
109s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-12-2022 14:40
Behavioral task
behavioral1
Sample
b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe
Resource
win10v2004-20220812-en
General
-
Target
b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe
-
Size
685KB
-
MD5
a6b4bc29b658725bededeb0c0ff0c351
-
SHA1
879f8dbc2f7ec45f4b12c3e6ed1c65e775c93036
-
SHA256
b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d
-
SHA512
2c657d7ec6b747f4c22d778b74f788e6898ccdc36086d92e734a12f31b1592233be2c61a2e22c5dcd0b753be530b38bbf1a5488b0db83ea2adaf802d6b29e356
-
SSDEEP
12288:3odmc22J9eWYo7R/LvqZynM8/kjAk2gQ1wwc3OqitK0bpxjmCAhp:3oMA92o7RDqZEM8/kZQ1i3CkCpxjmz
Malware Config
Signatures
-
Detect Neshta payload 47 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exesvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.compid process 888 b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe 1756 svchost.com 1732 B3D631~1.EXE 572 svchost.com 1580 B3D631~1.EXE 1784 svchost.com 1852 B3D631~1.EXE 1372 svchost.com 1236 B3D631~1.EXE 576 svchost.com 772 B3D631~1.EXE 1800 svchost.com 1644 B3D631~1.EXE 1168 svchost.com 920 B3D631~1.EXE 1376 svchost.com 980 B3D631~1.EXE 1436 svchost.com 2032 B3D631~1.EXE 376 svchost.com 1324 B3D631~1.EXE 1588 svchost.com 1628 B3D631~1.EXE 1872 svchost.com 1652 B3D631~1.EXE 1784 svchost.com 1704 B3D631~1.EXE 692 svchost.com 432 B3D631~1.EXE 1236 svchost.com 1108 B3D631~1.EXE 548 svchost.com 772 B3D631~1.EXE 672 svchost.com 1256 B3D631~1.EXE 1932 svchost.com 1252 B3D631~1.EXE 1168 svchost.com 976 B3D631~1.EXE 944 svchost.com 820 B3D631~1.EXE 1276 svchost.com 1720 B3D631~1.EXE 1520 svchost.com 660 B3D631~1.EXE 464 svchost.com 1924 B3D631~1.EXE 340 svchost.com 360 B3D631~1.EXE 1640 svchost.com 1948 B3D631~1.EXE 1764 svchost.com 680 B3D631~1.EXE 1164 svchost.com 1200 B3D631~1.EXE 1648 svchost.com 2024 B3D631~1.EXE 928 svchost.com 540 B3D631~1.EXE 1748 svchost.com 1816 B3D631~1.EXE 884 svchost.com 1796 B3D631~1.EXE 1252 svchost.com -
Loads dropped DLL 64 IoCs
Processes:
b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comb3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.compid process 2012 b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe 2012 b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe 1756 svchost.com 1756 svchost.com 572 svchost.com 572 svchost.com 1784 svchost.com 1784 svchost.com 1372 svchost.com 1372 svchost.com 576 svchost.com 576 svchost.com 1800 svchost.com 1800 svchost.com 1168 svchost.com 1168 svchost.com 1376 svchost.com 1376 svchost.com 1436 svchost.com 1436 svchost.com 376 svchost.com 376 svchost.com 1588 svchost.com 1588 svchost.com 1872 svchost.com 1872 svchost.com 1784 svchost.com 1784 svchost.com 692 svchost.com 692 svchost.com 1236 svchost.com 1236 svchost.com 888 b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe 548 svchost.com 2012 b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe 548 svchost.com 888 b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe 672 svchost.com 672 svchost.com 888 b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe 1932 svchost.com 1932 svchost.com 1168 svchost.com 1168 svchost.com 944 svchost.com 944 svchost.com 1276 svchost.com 1276 svchost.com 1520 svchost.com 1520 svchost.com 464 svchost.com 464 svchost.com 340 svchost.com 2012 b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe 340 svchost.com 1640 svchost.com 1640 svchost.com 1764 svchost.com 1764 svchost.com 1164 svchost.com 1164 svchost.com 1648 svchost.com 1648 svchost.com 928 svchost.com -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 1 IoCs
Processes:
description ioc process File created C:\Windows\SysWOW64\Macromed\Flash\Flash.ocx -
Drops file in Program Files directory 64 IoCs
Processes:
b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exeb3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exedescription ioc process File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe -
Drops file in Windows directory 64 IoCs
Processes:
svchost.comB3D631~1.EXEB3D631~1.EXEB3D631~1.EXEsvchost.comsvchost.comB3D631~1.EXEB3D631~1.EXEsvchost.comsvchost.comB3D631~1.EXEB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comsvchost.comB3D631~1.EXEB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comsvchost.comsvchost.comB3D631~1.EXEB3D631~1.EXEsvchost.comsvchost.comB3D631~1.EXEB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comsvchost.comsvchost.comB3D631~1.EXEB3D631~1.EXEB3D631~1.EXEB3D631~1.EXEB3D631~1.EXEsvchost.comsvchost.comB3D631~1.EXEB3D631~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEB3D631~1.EXEB3D631~1.EXEsvchost.comsvchost.comB3D631~1.EXEsvchost.comsvchost.comdescription ioc process File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys B3D631~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys B3D631~1.EXE File opened for modification C:\Windows\directx.sys B3D631~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys B3D631~1.EXE File opened for modification C:\Windows\svchost.com B3D631~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com B3D631~1.EXE File opened for modification C:\Windows\svchost.com B3D631~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com B3D631~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com B3D631~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com B3D631~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys B3D631~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys B3D631~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com B3D631~1.EXE File opened for modification C:\Windows\svchost.com B3D631~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com B3D631~1.EXE File opened for modification C:\Windows\svchost.com B3D631~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys B3D631~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys B3D631~1.EXE File opened for modification C:\Windows\directx.sys B3D631~1.EXE File opened for modification C:\Windows\directx.sys B3D631~1.EXE File opened for modification C:\Windows\directx.sys B3D631~1.EXE File opened for modification C:\Windows\directx.sys B3D631~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys B3D631~1.EXE File opened for modification C:\Windows\svchost.com B3D631~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com B3D631~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys B3D631~1.EXE File opened for modification C:\Windows\svchost.com B3D631~1.EXE File opened for modification C:\Windows\directx.sys B3D631~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com B3D631~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
Processes:
description ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Programmable Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.spl Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\ProxyStubClsid32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version\ = "1.0" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashProp.FlashProp.1 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.swf\Content Type = "application/x-shockwave-flash" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-shockwave-flash\CLSID = "{D27CDB6E-AE6D-11cf-96B8-444553540000}" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\FLAGS Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000} Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\TypeLib\Version = "1.0" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version\ = "1.0" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\EnableFullPage Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B}\1.0\ = "FlashAccessibility" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B}\1.0\FLAGS\ = "0" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\CurVer\ = "ShockwaveFlash.ShockwaveFlash.1" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\EnableFullPage\.swf Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus\ = "0" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000} Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID\ = "FlashFactory.FlashFactory.1" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/futuresplash Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.1\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashFactory.FlashFactory\CurVer Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\TypeLib\ = "{D27CDB6B-AE6D-11CF-96B8-444553540000}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\TypeLib\ = "{D27CDB6B-AE6D-11CF-96B8-444553540000}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FlashFactory.FlashFactory.1\ = "Macromedia Flash Factory Object" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashFactory.FlashFactory.1\CLSID Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\ = "Shockwave Flash Object" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.swf\ = "ShockwaveFlash.ShockwaveFlash" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\Macromed\\Flash\\" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\TypeLib\ = "{D27CDB6B-AE6D-11CF-96B8-444553540000}" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.1\CLSID Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1171A62F-05D2-11D1-83FC-00A0C9089C5A}\InprocServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.spl\ = "ShockwaveFlash.ShockwaveFlash" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-shockwave-flash Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1171A62F-05D2-11D1-83FC-00A0C9089C5A}\Programmable Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B}\1.0\0 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.3\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.4 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\ = "IShockwaveFlash" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\TypeLib Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FlashFactory.FlashFactory\CLSID\ = "{D27CDB70-AE6D-11cf-96B8-444553540000}" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.3\CLSID Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1171A62F-05D2-11D1-83FC-00A0C9089C5A} Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\HELPDIR Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B}\1.0\0\win32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.4\CLSID Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FlashProp.FlashProp\ = "FlashProp Class" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000} Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\ = "_IShockwaveFlashEvents" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FlashProp.FlashProp.1\ = "FlashProp Class" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\0 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashProp.FlashProp.1\CLSID -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exeb3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exesvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEsvchost.comB3D631~1.EXEdescription pid process target process PID 2012 wrote to memory of 888 2012 b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe PID 2012 wrote to memory of 888 2012 b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe PID 2012 wrote to memory of 888 2012 b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe PID 2012 wrote to memory of 888 2012 b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe PID 888 wrote to memory of 1756 888 b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe svchost.com PID 888 wrote to memory of 1756 888 b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe svchost.com PID 888 wrote to memory of 1756 888 b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe svchost.com PID 888 wrote to memory of 1756 888 b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe svchost.com PID 1756 wrote to memory of 1732 1756 svchost.com B3D631~1.EXE PID 1756 wrote to memory of 1732 1756 svchost.com B3D631~1.EXE PID 1756 wrote to memory of 1732 1756 svchost.com B3D631~1.EXE PID 1756 wrote to memory of 1732 1756 svchost.com B3D631~1.EXE PID 1732 wrote to memory of 572 1732 B3D631~1.EXE svchost.com PID 1732 wrote to memory of 572 1732 B3D631~1.EXE svchost.com PID 1732 wrote to memory of 572 1732 B3D631~1.EXE svchost.com PID 1732 wrote to memory of 572 1732 B3D631~1.EXE svchost.com PID 572 wrote to memory of 1580 572 svchost.com B3D631~1.EXE PID 572 wrote to memory of 1580 572 svchost.com B3D631~1.EXE PID 572 wrote to memory of 1580 572 svchost.com B3D631~1.EXE PID 572 wrote to memory of 1580 572 svchost.com B3D631~1.EXE PID 1580 wrote to memory of 1784 1580 B3D631~1.EXE svchost.com PID 1580 wrote to memory of 1784 1580 B3D631~1.EXE svchost.com PID 1580 wrote to memory of 1784 1580 B3D631~1.EXE svchost.com PID 1580 wrote to memory of 1784 1580 B3D631~1.EXE svchost.com PID 1784 wrote to memory of 1852 1784 svchost.com B3D631~1.EXE PID 1784 wrote to memory of 1852 1784 svchost.com B3D631~1.EXE PID 1784 wrote to memory of 1852 1784 svchost.com B3D631~1.EXE PID 1784 wrote to memory of 1852 1784 svchost.com B3D631~1.EXE PID 1852 wrote to memory of 1372 1852 B3D631~1.EXE svchost.com PID 1852 wrote to memory of 1372 1852 B3D631~1.EXE svchost.com PID 1852 wrote to memory of 1372 1852 B3D631~1.EXE svchost.com PID 1852 wrote to memory of 1372 1852 B3D631~1.EXE svchost.com PID 1372 wrote to memory of 1236 1372 svchost.com B3D631~1.EXE PID 1372 wrote to memory of 1236 1372 svchost.com B3D631~1.EXE PID 1372 wrote to memory of 1236 1372 svchost.com B3D631~1.EXE PID 1372 wrote to memory of 1236 1372 svchost.com B3D631~1.EXE PID 1236 wrote to memory of 576 1236 B3D631~1.EXE svchost.com PID 1236 wrote to memory of 576 1236 B3D631~1.EXE svchost.com PID 1236 wrote to memory of 576 1236 B3D631~1.EXE svchost.com PID 1236 wrote to memory of 576 1236 B3D631~1.EXE svchost.com PID 576 wrote to memory of 772 576 svchost.com B3D631~1.EXE PID 576 wrote to memory of 772 576 svchost.com B3D631~1.EXE PID 576 wrote to memory of 772 576 svchost.com B3D631~1.EXE PID 576 wrote to memory of 772 576 svchost.com B3D631~1.EXE PID 772 wrote to memory of 1800 772 B3D631~1.EXE svchost.com PID 772 wrote to memory of 1800 772 B3D631~1.EXE svchost.com PID 772 wrote to memory of 1800 772 B3D631~1.EXE svchost.com PID 772 wrote to memory of 1800 772 B3D631~1.EXE svchost.com PID 1800 wrote to memory of 1644 1800 svchost.com B3D631~1.EXE PID 1800 wrote to memory of 1644 1800 svchost.com B3D631~1.EXE PID 1800 wrote to memory of 1644 1800 svchost.com B3D631~1.EXE PID 1800 wrote to memory of 1644 1800 svchost.com B3D631~1.EXE PID 1644 wrote to memory of 1168 1644 B3D631~1.EXE svchost.com PID 1644 wrote to memory of 1168 1644 B3D631~1.EXE svchost.com PID 1644 wrote to memory of 1168 1644 B3D631~1.EXE svchost.com PID 1644 wrote to memory of 1168 1644 B3D631~1.EXE svchost.com PID 1168 wrote to memory of 920 1168 svchost.com B3D631~1.EXE PID 1168 wrote to memory of 920 1168 svchost.com B3D631~1.EXE PID 1168 wrote to memory of 920 1168 svchost.com B3D631~1.EXE PID 1168 wrote to memory of 920 1168 svchost.com B3D631~1.EXE PID 920 wrote to memory of 1376 920 B3D631~1.EXE svchost.com PID 920 wrote to memory of 1376 920 B3D631~1.EXE svchost.com PID 920 wrote to memory of 1376 920 B3D631~1.EXE svchost.com PID 920 wrote to memory of 1376 920 B3D631~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe"C:\Users\Admin\AppData\Local\Temp\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\b3d631cdece04c99a3e7ac5cea8d3bee0536c5c98e4413ebe869355a0cb1800d.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE18⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE20⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE22⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE24⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE26⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE28⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE30⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE32⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE34⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE36⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE38⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE40⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE42⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE44⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE46⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE48⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE50⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE52⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE54⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE56⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE58⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE60⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"61⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE62⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"63⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE64⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"65⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE66⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"67⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE68⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"69⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE70⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"71⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE72⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"73⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE74⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"75⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE76⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"77⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE78⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"79⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE80⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"81⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE82⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"83⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE84⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"85⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE86⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"87⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE88⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"89⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE90⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"91⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE92⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"93⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE94⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"95⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE96⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"97⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE98⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"99⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE100⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"101⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE102⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"103⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE104⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"105⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE106⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"107⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE108⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"109⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE110⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"111⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE112⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"113⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE114⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"115⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE116⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"117⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE118⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"119⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE120⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"121⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE122⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"123⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE124⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"125⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE126⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"127⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE128⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"129⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE130⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"131⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE132⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"133⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE134⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"135⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE136⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"137⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE138⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"139⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE140⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"141⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE142⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"143⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE144⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"145⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE146⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"147⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE148⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"149⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE150⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"151⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE152⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"153⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE154⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"155⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE156⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"157⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE158⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"159⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE160⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"161⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE162⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"163⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE164⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"165⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE166⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"167⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE168⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"169⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE170⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"171⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE172⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"173⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE174⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"175⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE176⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"177⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE178⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"179⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE180⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"181⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE182⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"183⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE184⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"185⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE186⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"187⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE188⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"189⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE190⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"191⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE192⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"193⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE194⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"195⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE196⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"197⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE198⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"199⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE200⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"201⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE202⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"203⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE204⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"205⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE206⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"207⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE208⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"209⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE210⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"211⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE212⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"213⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE214⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"215⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE216⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"217⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE218⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"219⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE220⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"221⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE222⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"223⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE224⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"225⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE226⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"227⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE228⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"229⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE230⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"231⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE232⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"233⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE234⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"235⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE236⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"237⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE238⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"239⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE240⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3D631~1.EXE"241⤵