Analysis
-
max time kernel
36s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 21:18
Behavioral task
behavioral1
Sample
0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe
Resource
win7-20240611-en
General
-
Target
0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe
-
Size
156KB
-
MD5
aa28630b1d123bb45b7362d0b4c4b100
-
SHA1
acdf7d95d6f81103271c81652ce5c3ca37dabab7
-
SHA256
0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c
-
SHA512
b92341f0fed290a10f660294626a92e41a82c3b9858075200ee76c25e3d750a0ddbe76921ab2c7aeac328e29d7fa97bedc4d47adb83a60aef8695c6392694fd7
-
SSDEEP
1536:JxqjQ+P04wsmJCwugrZpVnWw7V15Frrmie3Mz8enofIxQrFP+ZruOxqjQ+P04wsX:sr85CwugDVnj7V15FrvweZQhGZwr85C
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3582-490\0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe family_neshta C:\Windows\svchost.com family_neshta C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe family_neshta behavioral1/memory/2776-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2608-29-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2780-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2976-43-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2532-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2552-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2456-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/820-71-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2576-85-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/576-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2964-99-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2808-100-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1108-114-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1888-115-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe family_neshta behavioral1/memory/1968-138-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2464-137-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE family_neshta behavioral1/memory/1984-160-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1404-161-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1708-179-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2244-180-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2364-197-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1604-198-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1688-217-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1564-211-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/748-222-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1568-221-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2096-257-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/608-260-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2108-269-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1528-273-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2712-280-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2556-281-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2764-288-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2628-289-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2512-296-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2892-297-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2976-304-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2744-305-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2532-318-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2524-317-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/960-331-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/556-332-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2660-339-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2564-340-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2820-347-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1648-348-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1884-356-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1260-355-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/308-363-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2384-364-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1344-371-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2708-372-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1388-380-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1544-379-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1264-388-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2300-387-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Phorphiex payload 4 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3582-490\0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe family_phorphiex C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE family_phorphiex C:\Users\Admin\AppData\Local\Temp\2024133192.exe family_phorphiex C:\Users\Admin\AppData\Local\Temp\107127953.exe family_phorphiex -
Executes dropped EXE 64 IoCs
Processes:
0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exesvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.compid process 2864 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe 2776 svchost.com 2608 0F63FB~1.EXE 2780 svchost.com 2976 0F63FB~1.EXE 2532 svchost.com 2552 0F63FB~1.EXE 2456 svchost.com 820 0F63FB~1.EXE 576 svchost.com 2576 0F63FB~1.EXE 2808 svchost.com 2964 0F63FB~1.EXE 1888 svchost.com 1108 0F63FB~1.EXE 1968 svchost.com 2464 0F63FB~1.EXE 1404 svchost.com 1984 0F63FB~1.EXE 2244 svchost.com 1708 0F63FB~1.EXE 1604 svchost.com 2364 0F63FB~1.EXE 1688 svchost.com 1564 0F63FB~1.EXE 748 svchost.com 1568 0F63FB~1.EXE 608 svchost.com 2096 0F63FB~1.EXE 1528 svchost.com 2108 0F63FB~1.EXE 2556 svchost.com 2712 0F63FB~1.EXE 2628 svchost.com 2764 0F63FB~1.EXE 2892 svchost.com 2512 0F63FB~1.EXE 2744 svchost.com 2976 0F63FB~1.EXE 2524 svchost.com 2532 0F63FB~1.EXE 556 svchost.com 960 0F63FB~1.EXE 2660 svchost.com 2564 0F63FB~1.EXE 2820 svchost.com 1648 0F63FB~1.EXE 1884 svchost.com 1260 0F63FB~1.EXE 2384 svchost.com 308 0F63FB~1.EXE 2708 svchost.com 1344 0F63FB~1.EXE 1544 svchost.com 1388 0F63FB~1.EXE 1264 svchost.com 2300 0F63FB~1.EXE 2280 svchost.com 1404 0F63FB~1.EXE 1984 svchost.com 3024 0F63FB~1.EXE 1892 svchost.com 2340 0F63FB~1.EXE 3036 svchost.com -
Loads dropped DLL 64 IoCs
Processes:
0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.compid process 2868 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe 2868 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe 2776 svchost.com 2776 svchost.com 2780 svchost.com 2780 svchost.com 2532 svchost.com 2532 svchost.com 2456 svchost.com 2456 svchost.com 576 svchost.com 576 svchost.com 2808 svchost.com 2808 svchost.com 1888 svchost.com 1888 svchost.com 1968 svchost.com 1968 svchost.com 2864 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe 2868 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe 1404 svchost.com 1404 svchost.com 2868 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe 2868 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe 2244 svchost.com 2244 svchost.com 1604 svchost.com 1604 svchost.com 2864 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe 1688 svchost.com 1688 svchost.com 748 svchost.com 748 svchost.com 608 svchost.com 608 svchost.com 2868 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe 2868 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe 2868 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe 1528 svchost.com 1528 svchost.com 2556 svchost.com 2556 svchost.com 2628 svchost.com 2628 svchost.com 2892 svchost.com 2892 svchost.com 2744 svchost.com 2744 svchost.com 2524 svchost.com 2524 svchost.com 556 svchost.com 556 svchost.com 2660 svchost.com 2660 svchost.com 2820 svchost.com 2820 svchost.com 1884 svchost.com 1884 svchost.com 2384 svchost.com 2384 svchost.com 2708 svchost.com 2708 svchost.com 1544 svchost.com 1544 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exedescription ioc process File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe -
Drops file in Windows directory 64 IoCs
Processes:
svchost.com0F63FB~1.EXEsvchost.comsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXE0F63FB~1.EXE0F63FB~1.EXEsvchost.comsvchost.comsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXE0F63FB~1.EXEsvchost.comsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXE0F63FB~1.EXEsvchost.comsvchost.com0F63FB~1.EXE0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exesvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.comsvchost.com0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exesvchost.com0F63FB~1.EXE0F63FB~1.EXEsvchost.com0F63FB~1.EXE0F63FB~1.EXE0F63FB~1.EXE0F63FB~1.EXE0F63FB~1.EXE0F63FB~1.EXE0F63FB~1.EXEsvchost.comsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.comsvchost.com0F63FB~1.EXE0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com0F63FB~1.EXE0F63FB~1.EXE0F63FB~1.EXEdescription ioc process File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 0F63FB~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 0F63FB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 0F63FB~1.EXE File opened for modification C:\Windows\directx.sys 0F63FB~1.EXE File opened for modification C:\Windows\directx.sys 0F63FB~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 0F63FB~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 0F63FB~1.EXE File opened for modification C:\Windows\directx.sys 0F63FB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 0F63FB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 0F63FB~1.EXE File opened for modification C:\Windows\directx.sys 0F63FB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 0F63FB~1.EXE File opened for modification C:\Windows\svchost.com 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 0F63FB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 0F63FB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 0F63FB~1.EXE File opened for modification C:\Windows\directx.sys 0F63FB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 0F63FB~1.EXE File opened for modification C:\Windows\svchost.com 0F63FB~1.EXE File opened for modification C:\Windows\svchost.com 0F63FB~1.EXE File opened for modification C:\Windows\directx.sys 0F63FB~1.EXE File opened for modification C:\Windows\directx.sys 0F63FB~1.EXE File opened for modification C:\Windows\svchost.com 0F63FB~1.EXE File opened for modification C:\Windows\svchost.com 0F63FB~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 0F63FB~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 0F63FB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 0F63FB~1.EXE File opened for modification C:\Windows\svchost.com 0F63FB~1.EXE File opened for modification C:\Windows\svchost.com 0F63FB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 0F63FB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 0F63FB~1.EXE File opened for modification C:\Windows\directx.sys 0F63FB~1.EXE File opened for modification C:\Windows\svchost.com 0F63FB~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exesvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEsvchost.com0F63FB~1.EXEdescription pid process target process PID 2868 wrote to memory of 2864 2868 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe PID 2868 wrote to memory of 2864 2868 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe PID 2868 wrote to memory of 2864 2868 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe PID 2868 wrote to memory of 2864 2868 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe PID 2864 wrote to memory of 2776 2864 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe svchost.com PID 2864 wrote to memory of 2776 2864 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe svchost.com PID 2864 wrote to memory of 2776 2864 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe svchost.com PID 2864 wrote to memory of 2776 2864 0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe svchost.com PID 2776 wrote to memory of 2608 2776 svchost.com 0F63FB~1.EXE PID 2776 wrote to memory of 2608 2776 svchost.com 0F63FB~1.EXE PID 2776 wrote to memory of 2608 2776 svchost.com 0F63FB~1.EXE PID 2776 wrote to memory of 2608 2776 svchost.com 0F63FB~1.EXE PID 2608 wrote to memory of 2780 2608 0F63FB~1.EXE svchost.com PID 2608 wrote to memory of 2780 2608 0F63FB~1.EXE svchost.com PID 2608 wrote to memory of 2780 2608 0F63FB~1.EXE svchost.com PID 2608 wrote to memory of 2780 2608 0F63FB~1.EXE svchost.com PID 2780 wrote to memory of 2976 2780 svchost.com 0F63FB~1.EXE PID 2780 wrote to memory of 2976 2780 svchost.com 0F63FB~1.EXE PID 2780 wrote to memory of 2976 2780 svchost.com 0F63FB~1.EXE PID 2780 wrote to memory of 2976 2780 svchost.com 0F63FB~1.EXE PID 2976 wrote to memory of 2532 2976 0F63FB~1.EXE 0F63FB~1.EXE PID 2976 wrote to memory of 2532 2976 0F63FB~1.EXE 0F63FB~1.EXE PID 2976 wrote to memory of 2532 2976 0F63FB~1.EXE 0F63FB~1.EXE PID 2976 wrote to memory of 2532 2976 0F63FB~1.EXE 0F63FB~1.EXE PID 2532 wrote to memory of 2552 2532 svchost.com 0F63FB~1.EXE PID 2532 wrote to memory of 2552 2532 svchost.com 0F63FB~1.EXE PID 2532 wrote to memory of 2552 2532 svchost.com 0F63FB~1.EXE PID 2532 wrote to memory of 2552 2532 svchost.com 0F63FB~1.EXE PID 2552 wrote to memory of 2456 2552 0F63FB~1.EXE svchost.com PID 2552 wrote to memory of 2456 2552 0F63FB~1.EXE svchost.com PID 2552 wrote to memory of 2456 2552 0F63FB~1.EXE svchost.com PID 2552 wrote to memory of 2456 2552 0F63FB~1.EXE svchost.com PID 2456 wrote to memory of 820 2456 svchost.com svchost.com PID 2456 wrote to memory of 820 2456 svchost.com svchost.com PID 2456 wrote to memory of 820 2456 svchost.com svchost.com PID 2456 wrote to memory of 820 2456 svchost.com svchost.com PID 820 wrote to memory of 576 820 0F63FB~1.EXE svchost.com PID 820 wrote to memory of 576 820 0F63FB~1.EXE svchost.com PID 820 wrote to memory of 576 820 0F63FB~1.EXE svchost.com PID 820 wrote to memory of 576 820 0F63FB~1.EXE svchost.com PID 576 wrote to memory of 2576 576 svchost.com 0F63FB~1.EXE PID 576 wrote to memory of 2576 576 svchost.com 0F63FB~1.EXE PID 576 wrote to memory of 2576 576 svchost.com 0F63FB~1.EXE PID 576 wrote to memory of 2576 576 svchost.com 0F63FB~1.EXE PID 2576 wrote to memory of 2808 2576 0F63FB~1.EXE svchost.com PID 2576 wrote to memory of 2808 2576 0F63FB~1.EXE svchost.com PID 2576 wrote to memory of 2808 2576 0F63FB~1.EXE svchost.com PID 2576 wrote to memory of 2808 2576 0F63FB~1.EXE svchost.com PID 2808 wrote to memory of 2964 2808 svchost.com 0F63FB~1.EXE PID 2808 wrote to memory of 2964 2808 svchost.com 0F63FB~1.EXE PID 2808 wrote to memory of 2964 2808 svchost.com 0F63FB~1.EXE PID 2808 wrote to memory of 2964 2808 svchost.com 0F63FB~1.EXE PID 2964 wrote to memory of 1888 2964 0F63FB~1.EXE 0F63FB~1.EXE PID 2964 wrote to memory of 1888 2964 0F63FB~1.EXE 0F63FB~1.EXE PID 2964 wrote to memory of 1888 2964 0F63FB~1.EXE 0F63FB~1.EXE PID 2964 wrote to memory of 1888 2964 0F63FB~1.EXE 0F63FB~1.EXE PID 1888 wrote to memory of 1108 1888 svchost.com 0F63FB~1.EXE PID 1888 wrote to memory of 1108 1888 svchost.com 0F63FB~1.EXE PID 1888 wrote to memory of 1108 1888 svchost.com 0F63FB~1.EXE PID 1888 wrote to memory of 1108 1888 svchost.com 0F63FB~1.EXE PID 1108 wrote to memory of 1968 1108 0F63FB~1.EXE svchost.com PID 1108 wrote to memory of 1968 1108 0F63FB~1.EXE svchost.com PID 1108 wrote to memory of 1968 1108 0F63FB~1.EXE svchost.com PID 1108 wrote to memory of 1968 1108 0F63FB~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\0f63fbdacbf4c7c588befd9fbda6a8ee896995067929fbc2c374b259e4503c4c_NeikiAnalytics.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE12⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE18⤵
- Executes dropped EXE
PID:2464 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE20⤵
- Executes dropped EXE
PID:1984 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE22⤵
- Executes dropped EXE
PID:1708 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE24⤵
- Executes dropped EXE
PID:2364 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE26⤵
- Executes dropped EXE
PID:1564 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:748 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE28⤵
- Executes dropped EXE
PID:1568 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:608 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE30⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2096 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE32⤵
- Executes dropped EXE
PID:2108 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE34⤵
- Executes dropped EXE
PID:2712 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE36⤵
- Executes dropped EXE
PID:2764 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE38⤵
- Executes dropped EXE
PID:2512 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE40⤵
- Executes dropped EXE
PID:2976 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE42⤵
- Executes dropped EXE
PID:2532 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:556 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE44⤵
- Executes dropped EXE
PID:960 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE46⤵
- Executes dropped EXE
PID:2564 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE48⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1648 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE50⤵
- Executes dropped EXE
PID:1260 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE52⤵
- Executes dropped EXE
PID:308 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE54⤵
- Executes dropped EXE
PID:1344 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE56⤵
- Executes dropped EXE
PID:1388 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"57⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE58⤵
- Executes dropped EXE
PID:2300 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"59⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE60⤵
- Executes dropped EXE
PID:1404 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"61⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE62⤵
- Executes dropped EXE
PID:3024 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"63⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE64⤵
- Executes dropped EXE
PID:2340 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"65⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE66⤵PID:948
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"67⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE68⤵
- Drops file in Windows directory
PID:1028 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"69⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE70⤵PID:1688
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"71⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE72⤵PID:284
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"73⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE74⤵PID:2232
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"75⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE76⤵PID:1912
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"77⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE78⤵PID:1972
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"79⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE80⤵PID:2192
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"81⤵
- Drops file in Windows directory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE82⤵PID:2724
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"83⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE84⤵PID:2092
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"85⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE86⤵PID:1744
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"87⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE88⤵PID:2512
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"89⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE90⤵
- Drops file in Windows directory
PID:2976 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"91⤵
- Drops file in Windows directory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE92⤵PID:2552
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"93⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE94⤵PID:588
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"95⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE96⤵
- Drops file in Windows directory
PID:2812 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"97⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE98⤵PID:2200
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"99⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE100⤵
- Drops file in Windows directory
PID:1652 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"101⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE102⤵PID:1888
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"103⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE104⤵PID:1640
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"105⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE106⤵PID:3056
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"107⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE108⤵PID:1992
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"109⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE110⤵PID:2228
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"111⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE112⤵PID:2312
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"113⤵
- Drops file in Windows directory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE114⤵PID:2356
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"115⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE116⤵
- Drops file in Windows directory
PID:1284 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"117⤵
- Drops file in Windows directory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE118⤵PID:2364
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"119⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE120⤵PID:764
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"121⤵
- Drops file in Windows directory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE122⤵PID:1104
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"123⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE124⤵PID:2248
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"125⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE126⤵PID:1076
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"127⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE128⤵PID:2256
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"129⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE130⤵
- Drops file in Windows directory
PID:1592 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"131⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE132⤵PID:3008
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"133⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE134⤵PID:2732
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"135⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE136⤵PID:1748
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"137⤵
- Drops file in Windows directory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE138⤵PID:2652
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"139⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE140⤵
- Drops file in Windows directory
PID:2412 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"141⤵
- Drops file in Windows directory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE142⤵PID:2524
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"143⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE144⤵
- Drops file in Windows directory
PID:2552 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"145⤵
- Drops file in Windows directory
PID:588 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE146⤵PID:2804
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"147⤵
- Drops file in Windows directory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE148⤵PID:1536
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"149⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE150⤵PID:2576
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"151⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE152⤵PID:2008
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"153⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE154⤵
- Drops file in Windows directory
PID:1660 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"155⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE156⤵PID:1396
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"157⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE158⤵PID:860
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"159⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE160⤵PID:1732
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"161⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE162⤵PID:1376
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"163⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE164⤵PID:3012
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"165⤵
- Drops file in Windows directory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE166⤵
- Drops file in Windows directory
PID:1284 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"167⤵
- Drops file in Windows directory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE168⤵PID:840
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"169⤵
- Drops file in Windows directory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE170⤵PID:1564
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"171⤵
- Drops file in Windows directory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE172⤵PID:284
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"173⤵
- Drops file in Windows directory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE174⤵
- Drops file in Windows directory
PID:2248 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"175⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE176⤵PID:2052
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"177⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE178⤵PID:1972
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"179⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE180⤵PID:2180
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"181⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE182⤵PID:2716
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"183⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE184⤵PID:2844
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"185⤵
- Drops file in Windows directory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE186⤵PID:2776
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"187⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE188⤵
- Drops file in Windows directory
PID:2504 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"189⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE190⤵PID:2412
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"191⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE192⤵PID:1208
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"193⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE194⤵PID:1496
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"195⤵
- Drops file in Windows directory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE196⤵PID:2564
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"197⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE198⤵PID:2204
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"199⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE200⤵
- Drops file in Windows directory
PID:1260 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"201⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE202⤵PID:2700
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"203⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE204⤵
- Drops file in Windows directory
PID:1196 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"205⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE206⤵PID:1996
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"207⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE208⤵
- Drops file in Windows directory
PID:1180 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"209⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE210⤵PID:1724
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"211⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE212⤵PID:2224
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"213⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE214⤵PID:3012
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"215⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE216⤵
- Drops file in Windows directory
PID:1816 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"217⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE218⤵PID:2704
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"219⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE220⤵PID:1120
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"221⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE222⤵PID:2220
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"223⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE224⤵PID:2248
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"225⤵
- Drops file in Windows directory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE226⤵PID:2236
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"227⤵
- Drops file in Windows directory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE228⤵PID:1632
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"229⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE230⤵
- Drops file in Windows directory
PID:2192 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"231⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE232⤵PID:2712
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"233⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE234⤵
- Drops file in Windows directory
PID:940 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"235⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE236⤵PID:2876
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"237⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE238⤵PID:2504
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"239⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE240⤵PID:2596
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0F63FB~1.EXE"241⤵PID:1204
-