Analysis
-
max time kernel
158s -
max time network
117s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
29-01-2022 07:42
Static task
static1
Behavioral task
behavioral1
Sample
5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe
Resource
win10-en-20211208
General
-
Target
5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe
-
Size
6.6MB
-
MD5
041cdf8eba9e2419532fdc25df205224
-
SHA1
6e4f23723189e08d26933a0885a822c475bfc43b
-
SHA256
5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae
-
SHA512
c1223e08882b2428b439053b598d82753e02a9390e2eb3158fd4e0b55c88656d7143db4fb5d5f321bf2ff324de375f30a05b8ce7977579d802115db7b0cc1891
Malware Config
Signatures
-
Detect Neshta Payload 46 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta C:\Windows\svchost.com family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe family_neshta C:\Windows\svchost.com family_neshta C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe family_neshta C:\Windows\svchost.com family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exesvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.compid process 1096 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe 580 svchost.com 1652 5C4C1B~1.EXE 1692 svchost.com 1324 5C4C1B~1.EXE 1828 svchost.com 1884 5C4C1B~1.EXE 1380 svchost.com 1592 5C4C1B~1.EXE 1008 svchost.com 1004 5C4C1B~1.EXE 1704 svchost.com 568 5C4C1B~1.EXE 1476 svchost.com 1328 5C4C1B~1.EXE 616 svchost.com 2032 5C4C1B~1.EXE 1928 svchost.com 1720 5C4C1B~1.EXE 1656 svchost.com 320 5C4C1B~1.EXE 580 svchost.com 1480 5C4C1B~1.EXE 296 svchost.com 1992 5C4C1B~1.EXE 1976 svchost.com 516 5C4C1B~1.EXE 1552 svchost.com 1984 5C4C1B~1.EXE 440 svchost.com 1796 5C4C1B~1.EXE 1628 svchost.com 1824 5C4C1B~1.EXE 1296 svchost.com 1744 5C4C1B~1.EXE 1004 svchost.com 1964 5C4C1B~1.EXE 568 svchost.com 1736 5C4C1B~1.EXE 904 svchost.com 740 5C4C1B~1.EXE 1432 svchost.com 616 5C4C1B~1.EXE 1388 svchost.com 1588 5C4C1B~1.EXE 996 svchost.com 1928 5C4C1B~1.EXE 1164 svchost.com 368 5C4C1B~1.EXE 1196 svchost.com 1832 5C4C1B~1.EXE 1656 svchost.com 1376 5C4C1B~1.EXE 828 svchost.com 1692 5C4C1B~1.EXE 1868 svchost.com 1836 5C4C1B~1.EXE 1884 svchost.com 1108 5C4C1B~1.EXE 1984 svchost.com 1592 5C4C1B~1.EXE 1796 svchost.com 1932 5C4C1B~1.EXE 1824 svchost.com -
Loads dropped DLL 64 IoCs
Processes:
5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.compid process 744 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe 744 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe 580 svchost.com 580 svchost.com 1692 svchost.com 1692 svchost.com 1828 svchost.com 1828 svchost.com 1380 svchost.com 1380 svchost.com 1008 svchost.com 1008 svchost.com 1704 svchost.com 1704 svchost.com 1476 svchost.com 1476 svchost.com 616 svchost.com 616 svchost.com 1928 svchost.com 1928 svchost.com 1656 svchost.com 1656 svchost.com 580 svchost.com 580 svchost.com 296 svchost.com 296 svchost.com 1976 svchost.com 1976 svchost.com 1552 svchost.com 1552 svchost.com 440 svchost.com 440 svchost.com 1628 svchost.com 1628 svchost.com 1296 svchost.com 1296 svchost.com 1004 svchost.com 1004 svchost.com 568 svchost.com 568 svchost.com 904 svchost.com 904 svchost.com 1432 svchost.com 1432 svchost.com 1388 svchost.com 1388 svchost.com 996 svchost.com 996 svchost.com 1164 svchost.com 1164 svchost.com 1196 svchost.com 1196 svchost.com 1656 svchost.com 1656 svchost.com 828 svchost.com 828 svchost.com 1868 svchost.com 1868 svchost.com 1884 svchost.com 1884 svchost.com 1984 svchost.com 1984 svchost.com 1796 svchost.com 1796 svchost.com -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exedescription ioc process File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe -
Drops file in Windows directory 64 IoCs
Processes:
svchost.com5C4C1B~1.EXEsvchost.comsvchost.com5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXEsvchost.comsvchost.com5C4C1B~1.EXEsvchost.comsvchost.comsvchost.comsvchost.com5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.comsvchost.comsvchost.comsvchost.com5C4C1B~1.EXE5C4C1B~1.EXEsvchost.com5C4C1B~1.EXE5C4C1B~1.EXE5C4C1B~1.EXEsvchost.comsvchost.com5C4C1B~1.EXEsvchost.comsvchost.com5C4C1B~1.EXEsvchost.comsvchost.com5C4C1B~1.EXE5C4C1B~1.EXEsvchost.comsvchost.com5C4C1B~1.EXEsvchost.comsvchost.com5C4C1B~1.EXEdescription ioc process File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 5C4C1B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 5C4C1B~1.EXE File opened for modification C:\Windows\directx.sys 5C4C1B~1.EXE File opened for modification C:\Windows\directx.sys 5C4C1B~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 5C4C1B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 5C4C1B~1.EXE File opened for modification C:\Windows\directx.sys 5C4C1B~1.EXE File opened for modification C:\Windows\svchost.com 5C4C1B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys 5C4C1B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com 5C4C1B~1.EXE File opened for modification C:\Windows\svchost.com 5C4C1B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 5C4C1B~1.EXE File opened for modification C:\Windows\svchost.com 5C4C1B~1.EXE File opened for modification C:\Windows\directx.sys 5C4C1B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 5C4C1B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 5C4C1B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 5C4C1B~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com 5C4C1B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 5C4C1B~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 5C4C1B~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exesvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEsvchost.com5C4C1B~1.EXEdescription pid process target process PID 744 wrote to memory of 1096 744 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe PID 744 wrote to memory of 1096 744 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe PID 744 wrote to memory of 1096 744 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe PID 744 wrote to memory of 1096 744 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe PID 1096 wrote to memory of 580 1096 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe svchost.com PID 1096 wrote to memory of 580 1096 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe svchost.com PID 1096 wrote to memory of 580 1096 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe svchost.com PID 1096 wrote to memory of 580 1096 5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe svchost.com PID 580 wrote to memory of 1652 580 svchost.com 5C4C1B~1.EXE PID 580 wrote to memory of 1652 580 svchost.com 5C4C1B~1.EXE PID 580 wrote to memory of 1652 580 svchost.com 5C4C1B~1.EXE PID 580 wrote to memory of 1652 580 svchost.com 5C4C1B~1.EXE PID 1652 wrote to memory of 1692 1652 5C4C1B~1.EXE svchost.com PID 1652 wrote to memory of 1692 1652 5C4C1B~1.EXE svchost.com PID 1652 wrote to memory of 1692 1652 5C4C1B~1.EXE svchost.com PID 1652 wrote to memory of 1692 1652 5C4C1B~1.EXE svchost.com PID 1692 wrote to memory of 1324 1692 svchost.com 5C4C1B~1.EXE PID 1692 wrote to memory of 1324 1692 svchost.com 5C4C1B~1.EXE PID 1692 wrote to memory of 1324 1692 svchost.com 5C4C1B~1.EXE PID 1692 wrote to memory of 1324 1692 svchost.com 5C4C1B~1.EXE PID 1324 wrote to memory of 1828 1324 5C4C1B~1.EXE svchost.com PID 1324 wrote to memory of 1828 1324 5C4C1B~1.EXE svchost.com PID 1324 wrote to memory of 1828 1324 5C4C1B~1.EXE svchost.com PID 1324 wrote to memory of 1828 1324 5C4C1B~1.EXE svchost.com PID 1828 wrote to memory of 1884 1828 svchost.com 5C4C1B~1.EXE PID 1828 wrote to memory of 1884 1828 svchost.com 5C4C1B~1.EXE PID 1828 wrote to memory of 1884 1828 svchost.com 5C4C1B~1.EXE PID 1828 wrote to memory of 1884 1828 svchost.com 5C4C1B~1.EXE PID 1884 wrote to memory of 1380 1884 5C4C1B~1.EXE svchost.com PID 1884 wrote to memory of 1380 1884 5C4C1B~1.EXE svchost.com PID 1884 wrote to memory of 1380 1884 5C4C1B~1.EXE svchost.com PID 1884 wrote to memory of 1380 1884 5C4C1B~1.EXE svchost.com PID 1380 wrote to memory of 1592 1380 svchost.com 5C4C1B~1.EXE PID 1380 wrote to memory of 1592 1380 svchost.com 5C4C1B~1.EXE PID 1380 wrote to memory of 1592 1380 svchost.com 5C4C1B~1.EXE PID 1380 wrote to memory of 1592 1380 svchost.com 5C4C1B~1.EXE PID 1592 wrote to memory of 1008 1592 5C4C1B~1.EXE svchost.com PID 1592 wrote to memory of 1008 1592 5C4C1B~1.EXE svchost.com PID 1592 wrote to memory of 1008 1592 5C4C1B~1.EXE svchost.com PID 1592 wrote to memory of 1008 1592 5C4C1B~1.EXE svchost.com PID 1008 wrote to memory of 1004 1008 svchost.com 5C4C1B~1.EXE PID 1008 wrote to memory of 1004 1008 svchost.com 5C4C1B~1.EXE PID 1008 wrote to memory of 1004 1008 svchost.com 5C4C1B~1.EXE PID 1008 wrote to memory of 1004 1008 svchost.com 5C4C1B~1.EXE PID 1004 wrote to memory of 1704 1004 5C4C1B~1.EXE svchost.com PID 1004 wrote to memory of 1704 1004 5C4C1B~1.EXE svchost.com PID 1004 wrote to memory of 1704 1004 5C4C1B~1.EXE svchost.com PID 1004 wrote to memory of 1704 1004 5C4C1B~1.EXE svchost.com PID 1704 wrote to memory of 568 1704 svchost.com 5C4C1B~1.EXE PID 1704 wrote to memory of 568 1704 svchost.com 5C4C1B~1.EXE PID 1704 wrote to memory of 568 1704 svchost.com 5C4C1B~1.EXE PID 1704 wrote to memory of 568 1704 svchost.com 5C4C1B~1.EXE PID 568 wrote to memory of 1476 568 5C4C1B~1.EXE svchost.com PID 568 wrote to memory of 1476 568 5C4C1B~1.EXE svchost.com PID 568 wrote to memory of 1476 568 5C4C1B~1.EXE svchost.com PID 568 wrote to memory of 1476 568 5C4C1B~1.EXE svchost.com PID 1476 wrote to memory of 1328 1476 svchost.com 5C4C1B~1.EXE PID 1476 wrote to memory of 1328 1476 svchost.com 5C4C1B~1.EXE PID 1476 wrote to memory of 1328 1476 svchost.com 5C4C1B~1.EXE PID 1476 wrote to memory of 1328 1476 svchost.com 5C4C1B~1.EXE PID 1328 wrote to memory of 616 1328 5C4C1B~1.EXE svchost.com PID 1328 wrote to memory of 616 1328 5C4C1B~1.EXE svchost.com PID 1328 wrote to memory of 616 1328 5C4C1B~1.EXE svchost.com PID 1328 wrote to memory of 616 1328 5C4C1B~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe"C:\Users\Admin\AppData\Local\Temp\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\5c4c1b97678dc8a88649b0e65f816df537ae2ae500b858d2107ebdbd710245ae.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE6⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:616 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE18⤵
- Executes dropped EXE
PID:2032 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE20⤵
- Executes dropped EXE
PID:1720 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE22⤵
- Executes dropped EXE
PID:320 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE24⤵
- Executes dropped EXE
PID:1480 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:296 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE26⤵
- Executes dropped EXE
PID:1992 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE28⤵
- Executes dropped EXE
PID:516 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE30⤵
- Executes dropped EXE
PID:1984 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:440 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE32⤵
- Executes dropped EXE
PID:1796 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE34⤵
- Executes dropped EXE
PID:1824 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE36⤵
- Executes dropped EXE
PID:1744 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE38⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE40⤵
- Executes dropped EXE
PID:1736 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE42⤵
- Executes dropped EXE
PID:740 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE44⤵
- Executes dropped EXE
PID:616 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE46⤵
- Executes dropped EXE
PID:1588 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE48⤵
- Executes dropped EXE
PID:1928 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE50⤵
- Executes dropped EXE
PID:368 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE52⤵
- Executes dropped EXE
PID:1832 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE54⤵
- Executes dropped EXE
PID:1376 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE56⤵
- Executes dropped EXE
PID:1692 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE58⤵
- Executes dropped EXE
PID:1836 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE60⤵
- Executes dropped EXE
PID:1108 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE62⤵
- Executes dropped EXE
PID:1592 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE64⤵
- Executes dropped EXE
PID:1932 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"65⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE66⤵PID:956
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"67⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE68⤵PID:2004
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"69⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE70⤵PID:1160
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"71⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE72⤵PID:1544
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"73⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE74⤵PID:1520
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"75⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE76⤵PID:2032
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"77⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE78⤵PID:1436
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"79⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE80⤵PID:1928
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"81⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE82⤵PID:368
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"83⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE84⤵PID:976
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"85⤵
- Drops file in Windows directory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE86⤵
- Drops file in Windows directory
PID:932 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"87⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE88⤵PID:1692
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"89⤵
- Drops file in Windows directory
PID:516 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE90⤵PID:1696
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"91⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE92⤵PID:1564
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"93⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE94⤵PID:1984
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"95⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE96⤵PID:1932
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"97⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE98⤵
- Drops file in Windows directory
PID:956 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"99⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE100⤵PID:1776
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"101⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE102⤵PID:1736
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"103⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE104⤵PID:1988
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"105⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE106⤵PID:1504
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"107⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE108⤵PID:1584
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"109⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE110⤵PID:1484
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"111⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE112⤵PID:796
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"113⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE114⤵PID:1480
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"115⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE116⤵PID:1324
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"117⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE118⤵PID:1364
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"119⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE120⤵PID:1828
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"121⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE122⤵PID:1380
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"123⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE124⤵PID:936
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"125⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE126⤵PID:1724
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"127⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE128⤵PID:1016
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"129⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE130⤵PID:2004
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"131⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE132⤵PID:568
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"133⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE134⤵PID:1360
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"135⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE136⤵PID:1820
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"137⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE138⤵PID:2012
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"139⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE140⤵PID:1616
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"141⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE142⤵PID:1500
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"143⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE144⤵PID:368
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"145⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE146⤵PID:1376
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"147⤵
- Drops file in Windows directory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE148⤵PID:972
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"149⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE150⤵PID:516
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"151⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE152⤵PID:1952
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"153⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE154⤵PID:1916
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"155⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE156⤵PID:1296
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"157⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE158⤵PID:1356
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"159⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE160⤵PID:1704
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"161⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE162⤵PID:900
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"163⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE164⤵PID:1608
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"165⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE166⤵PID:616
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"167⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE168⤵PID:556
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"169⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE170⤵PID:320
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"171⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE172⤵PID:564
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"173⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE174⤵
- Drops file in Windows directory
PID:296 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"175⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE176⤵PID:1324
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"177⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE178⤵PID:1548
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"179⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE180⤵PID:2000
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"181⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE182⤵PID:1620
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"183⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE184⤵PID:1688
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"185⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE186⤵PID:1724
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"187⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE188⤵PID:1732
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"189⤵
- Drops file in Windows directory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE190⤵PID:688
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"191⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE192⤵PID:568
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"193⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE194⤵PID:1432
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"195⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE196⤵PID:1820
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"197⤵
- Drops file in Windows directory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE198⤵PID:908
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"199⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE200⤵PID:996
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"201⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE202⤵PID:1500
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"203⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE204⤵PID:1196
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"205⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE206⤵PID:1804
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"207⤵
- Drops file in Windows directory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE208⤵PID:1488
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"209⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE210⤵
- Drops file in Windows directory
PID:1872 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"211⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE212⤵PID:1108
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"213⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE214⤵PID:936
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"215⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE216⤵PID:1744
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"217⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE218⤵PID:1732
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"219⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE220⤵PID:688
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"221⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE222⤵PID:1988
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"223⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE224⤵PID:680
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"225⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE226⤵PID:672
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"227⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE228⤵PID:1436
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"229⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE230⤵PID:996
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"231⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE232⤵PID:1800
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"233⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE234⤵PID:1656
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"235⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE236⤵PID:1868
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"237⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE238⤵PID:1884
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"239⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE240⤵PID:1620
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5C4C1B~1.EXE"241⤵PID:1564
-