Analysis
-
max time kernel
151s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
06-02-2022 13:57
Static task
static1
Behavioral task
behavioral1
Sample
2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe
Resource
win10v2004-en-20220113
General
-
Target
2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe
-
Size
1.6MB
-
MD5
c5e204baec4a3995fd6ccaef20f0888d
-
SHA1
3e56bf9a91605df8aa6a576b5c2270c522926372
-
SHA256
2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb
-
SHA512
93163d6c30ade44906198a81905f97454881f4dcdeee6cdc8dc620d4c09a5d0e0613715214e7baabc4745bc5f9b394e4d0788e2497f179d3043a8540757a20dd
Malware Config
Signatures
-
Detect Neshta Payload 46 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exesvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.compid process 1648 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe 940 svchost.com 1292 2C935D~1.EXE 1028 svchost.com 760 2C935D~1.EXE 572 svchost.com 1652 2C935D~1.EXE 1828 svchost.com 1836 2C935D~1.EXE 1804 svchost.com 1876 2C935D~1.EXE 1504 svchost.com 1524 2C935D~1.EXE 1388 svchost.com 1380 2C935D~1.EXE 1748 svchost.com 1924 2C935D~1.EXE 1708 svchost.com 752 2C935D~1.EXE 1472 svchost.com 1032 2C935D~1.EXE 468 svchost.com 1036 2C935D~1.EXE 1092 svchost.com 1452 2C935D~1.EXE 428 svchost.com 1520 2C935D~1.EXE 336 svchost.com 964 2C935D~1.EXE 432 svchost.com 1828 2C935D~1.EXE 924 svchost.com 660 2C935D~1.EXE 1124 svchost.com 1976 2C935D~1.EXE 1776 svchost.com 1504 2C935D~1.EXE 1896 svchost.com 612 2C935D~1.EXE 1288 svchost.com 1388 2C935D~1.EXE 1604 svchost.com 1580 2C935D~1.EXE 1436 svchost.com 800 2C935D~1.EXE 1592 svchost.com 1712 2C935D~1.EXE 600 svchost.com 520 2C935D~1.EXE 1540 svchost.com 1036 2C935D~1.EXE 1064 svchost.com 544 2C935D~1.EXE 1860 svchost.com 592 2C935D~1.EXE 1104 svchost.com 808 2C935D~1.EXE 1796 svchost.com 1772 2C935D~1.EXE 1640 svchost.com 924 2C935D~1.EXE 1460 svchost.com 1876 2C935D~1.EXE 1624 svchost.com -
Loads dropped DLL 64 IoCs
Processes:
2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.compid process 1432 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe 1432 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe 940 svchost.com 940 svchost.com 1028 svchost.com 1028 svchost.com 572 svchost.com 572 svchost.com 1828 svchost.com 1828 svchost.com 1804 svchost.com 1804 svchost.com 1504 svchost.com 1504 svchost.com 1388 svchost.com 1388 svchost.com 1748 svchost.com 1748 svchost.com 1708 svchost.com 1708 svchost.com 1472 svchost.com 1472 svchost.com 468 svchost.com 468 svchost.com 1092 svchost.com 1092 svchost.com 428 svchost.com 428 svchost.com 336 svchost.com 336 svchost.com 432 svchost.com 432 svchost.com 924 svchost.com 924 svchost.com 1124 svchost.com 1124 svchost.com 1776 svchost.com 1776 svchost.com 1648 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe 1648 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe 1896 svchost.com 1896 svchost.com 1432 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe 1288 svchost.com 1288 svchost.com 1604 svchost.com 1604 svchost.com 1436 svchost.com 1436 svchost.com 1592 svchost.com 1592 svchost.com 600 svchost.com 600 svchost.com 1540 svchost.com 1540 svchost.com 1432 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe 1064 svchost.com 1064 svchost.com 1860 svchost.com 1860 svchost.com 1104 svchost.com 1104 svchost.com 1796 svchost.com 1796 svchost.com -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exedescription ioc process File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe -
Drops file in Windows directory 64 IoCs
Processes:
2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.comsvchost.comsvchost.com2C935D~1.EXE2C935D~1.EXE2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXE2C935D~1.EXEsvchost.com2C935D~1.EXE2C935D~1.EXEsvchost.com2C935D~1.EXE2C935D~1.EXE2C935D~1.EXE2C935D~1.EXEsvchost.com2C935D~1.EXE2C935D~1.EXEsvchost.com2C935D~1.EXE2C935D~1.EXEsvchost.comsvchost.com2C935D~1.EXEsvchost.comsvchost.com2C935D~1.EXEsvchost.comdescription ioc process File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com 2C935D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2C935D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com 2C935D~1.EXE File opened for modification C:\Windows\svchost.com 2C935D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com 2C935D~1.EXE File opened for modification C:\Windows\svchost.com 2C935D~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2C935D~1.EXE File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\svchost.com 2C935D~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2C935D~1.EXE File opened for modification C:\Windows\svchost.com 2C935D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2C935D~1.EXE File opened for modification C:\Windows\directx.sys 2C935D~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2C935D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com 2C935D~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exesvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEsvchost.com2C935D~1.EXEdescription pid process target process PID 1432 wrote to memory of 1648 1432 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe PID 1432 wrote to memory of 1648 1432 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe PID 1432 wrote to memory of 1648 1432 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe PID 1432 wrote to memory of 1648 1432 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe PID 1648 wrote to memory of 940 1648 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe svchost.com PID 1648 wrote to memory of 940 1648 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe svchost.com PID 1648 wrote to memory of 940 1648 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe svchost.com PID 1648 wrote to memory of 940 1648 2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe svchost.com PID 940 wrote to memory of 1292 940 svchost.com 2C935D~1.EXE PID 940 wrote to memory of 1292 940 svchost.com 2C935D~1.EXE PID 940 wrote to memory of 1292 940 svchost.com 2C935D~1.EXE PID 940 wrote to memory of 1292 940 svchost.com 2C935D~1.EXE PID 1292 wrote to memory of 1028 1292 2C935D~1.EXE svchost.com PID 1292 wrote to memory of 1028 1292 2C935D~1.EXE svchost.com PID 1292 wrote to memory of 1028 1292 2C935D~1.EXE svchost.com PID 1292 wrote to memory of 1028 1292 2C935D~1.EXE svchost.com PID 1028 wrote to memory of 760 1028 svchost.com 2C935D~1.EXE PID 1028 wrote to memory of 760 1028 svchost.com 2C935D~1.EXE PID 1028 wrote to memory of 760 1028 svchost.com 2C935D~1.EXE PID 1028 wrote to memory of 760 1028 svchost.com 2C935D~1.EXE PID 760 wrote to memory of 572 760 2C935D~1.EXE svchost.com PID 760 wrote to memory of 572 760 2C935D~1.EXE svchost.com PID 760 wrote to memory of 572 760 2C935D~1.EXE svchost.com PID 760 wrote to memory of 572 760 2C935D~1.EXE svchost.com PID 572 wrote to memory of 1652 572 svchost.com 2C935D~1.EXE PID 572 wrote to memory of 1652 572 svchost.com 2C935D~1.EXE PID 572 wrote to memory of 1652 572 svchost.com 2C935D~1.EXE PID 572 wrote to memory of 1652 572 svchost.com 2C935D~1.EXE PID 1652 wrote to memory of 1828 1652 2C935D~1.EXE svchost.com PID 1652 wrote to memory of 1828 1652 2C935D~1.EXE svchost.com PID 1652 wrote to memory of 1828 1652 2C935D~1.EXE svchost.com PID 1652 wrote to memory of 1828 1652 2C935D~1.EXE svchost.com PID 1828 wrote to memory of 1836 1828 svchost.com 2C935D~1.EXE PID 1828 wrote to memory of 1836 1828 svchost.com 2C935D~1.EXE PID 1828 wrote to memory of 1836 1828 svchost.com 2C935D~1.EXE PID 1828 wrote to memory of 1836 1828 svchost.com 2C935D~1.EXE PID 1836 wrote to memory of 1804 1836 2C935D~1.EXE svchost.com PID 1836 wrote to memory of 1804 1836 2C935D~1.EXE svchost.com PID 1836 wrote to memory of 1804 1836 2C935D~1.EXE svchost.com PID 1836 wrote to memory of 1804 1836 2C935D~1.EXE svchost.com PID 1804 wrote to memory of 1876 1804 svchost.com 2C935D~1.EXE PID 1804 wrote to memory of 1876 1804 svchost.com 2C935D~1.EXE PID 1804 wrote to memory of 1876 1804 svchost.com 2C935D~1.EXE PID 1804 wrote to memory of 1876 1804 svchost.com 2C935D~1.EXE PID 1876 wrote to memory of 1504 1876 2C935D~1.EXE svchost.com PID 1876 wrote to memory of 1504 1876 2C935D~1.EXE svchost.com PID 1876 wrote to memory of 1504 1876 2C935D~1.EXE svchost.com PID 1876 wrote to memory of 1504 1876 2C935D~1.EXE svchost.com PID 1504 wrote to memory of 1524 1504 svchost.com 2C935D~1.EXE PID 1504 wrote to memory of 1524 1504 svchost.com 2C935D~1.EXE PID 1504 wrote to memory of 1524 1504 svchost.com 2C935D~1.EXE PID 1504 wrote to memory of 1524 1504 svchost.com 2C935D~1.EXE PID 1524 wrote to memory of 1388 1524 2C935D~1.EXE svchost.com PID 1524 wrote to memory of 1388 1524 2C935D~1.EXE svchost.com PID 1524 wrote to memory of 1388 1524 2C935D~1.EXE svchost.com PID 1524 wrote to memory of 1388 1524 2C935D~1.EXE svchost.com PID 1388 wrote to memory of 1380 1388 svchost.com 2C935D~1.EXE PID 1388 wrote to memory of 1380 1388 svchost.com 2C935D~1.EXE PID 1388 wrote to memory of 1380 1388 svchost.com 2C935D~1.EXE PID 1388 wrote to memory of 1380 1388 svchost.com 2C935D~1.EXE PID 1380 wrote to memory of 1748 1380 2C935D~1.EXE svchost.com PID 1380 wrote to memory of 1748 1380 2C935D~1.EXE svchost.com PID 1380 wrote to memory of 1748 1380 2C935D~1.EXE svchost.com PID 1380 wrote to memory of 1748 1380 2C935D~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe"C:\Users\Admin\AppData\Local\Temp\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\2c935d198c7b89d6812ceedb05dfd8b885ee6fcd4e16dc434dfc21f0f19930eb.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE12⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE16⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE18⤵
- Executes dropped EXE
PID:1924 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE20⤵
- Executes dropped EXE
PID:752 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE22⤵
- Executes dropped EXE
PID:1032 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:468 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE24⤵
- Executes dropped EXE
PID:1036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE26⤵
- Executes dropped EXE
PID:1452 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:428 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE28⤵
- Executes dropped EXE
PID:1520 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:336 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE30⤵
- Executes dropped EXE
PID:964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:432 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE32⤵
- Executes dropped EXE
PID:1828 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE34⤵
- Executes dropped EXE
PID:660 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE36⤵
- Executes dropped EXE
PID:1976 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE38⤵
- Executes dropped EXE
PID:1504 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE40⤵
- Executes dropped EXE
PID:612 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE42⤵
- Executes dropped EXE
PID:1388 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE44⤵
- Executes dropped EXE
PID:1580 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE46⤵
- Executes dropped EXE
PID:800 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE48⤵
- Executes dropped EXE
PID:1712 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:600 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE50⤵
- Executes dropped EXE
PID:520 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE52⤵
- Executes dropped EXE
PID:1036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE54⤵
- Executes dropped EXE
PID:544 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE56⤵
- Executes dropped EXE
PID:592 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE58⤵
- Executes dropped EXE
PID:808 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE60⤵
- Executes dropped EXE
PID:1772 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"61⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE62⤵
- Executes dropped EXE
PID:924 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"63⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE64⤵
- Executes dropped EXE
PID:1876 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"65⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE66⤵PID:952
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"67⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE68⤵
- Drops file in Windows directory
PID:1284 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"69⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE70⤵PID:1740
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"71⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE72⤵PID:1364
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"73⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE74⤵PID:1312
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"75⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE76⤵PID:1688
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"77⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE78⤵PID:268
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"79⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE80⤵PID:944
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"81⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE82⤵PID:1028
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"83⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE84⤵PID:1520
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"85⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE86⤵PID:336
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"87⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE88⤵
- Drops file in Windows directory
PID:1828 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"89⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE90⤵PID:1168
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"91⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE92⤵PID:1568
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"93⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE94⤵PID:1940
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"95⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE96⤵PID:1896
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"97⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE98⤵PID:1872
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"99⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE100⤵PID:1604
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"101⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE102⤵PID:1736
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"103⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE104⤵PID:656
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"105⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE106⤵PID:1588
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"107⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE108⤵PID:520
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"109⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE110⤵PID:944
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"111⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE112⤵PID:1028
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"113⤵
- Drops file in Windows directory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE114⤵PID:964
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"115⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE116⤵PID:592
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"117⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE118⤵PID:1828
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"119⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE120⤵PID:660
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"121⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE122⤵PID:1568
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"123⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE124⤵PID:1940
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"125⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE126⤵PID:1724
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"127⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE128⤵PID:1748
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"129⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE130⤵PID:748
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"131⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE132⤵PID:1820
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"133⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE134⤵PID:1708
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"135⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE136⤵PID:1548
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"137⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE138⤵PID:1452
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"139⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE140⤵PID:428
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"141⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE142⤵PID:1304
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"143⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE144⤵PID:432
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"145⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE146⤵PID:1040
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"147⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE148⤵PID:1124
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"149⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE150⤵PID:1512
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"151⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE152⤵PID:1380
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"153⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE154⤵PID:1392
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"155⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE156⤵PID:1964
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"157⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE158⤵PID:1604
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"159⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE160⤵PID:800
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"161⤵
- Drops file in Windows directory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE162⤵PID:960
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"163⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE164⤵PID:760
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"165⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE166⤵PID:1548
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"167⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE168⤵PID:1652
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"169⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE170⤵PID:1136
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"171⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE172⤵PID:336
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"173⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE174⤵PID:1272
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"175⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE176⤵PID:1168
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"177⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE178⤵PID:1640
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"179⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE180⤵PID:1632
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"181⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE182⤵PID:612
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"183⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE184⤵PID:1388
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"185⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE186⤵PID:752
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"187⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE188⤵PID:1800
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"189⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE190⤵PID:1820
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"191⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE192⤵PID:1708
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"193⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE194⤵PID:1540
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"195⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE196⤵PID:1528
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"197⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE198⤵PID:1596
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"199⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE200⤵PID:544
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"201⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE202⤵PID:336
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"203⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE204⤵
- Drops file in Windows directory
PID:316 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"205⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE206⤵PID:1168
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"207⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE208⤵PID:1512
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"209⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE210⤵PID:1380
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"211⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE212⤵PID:1392
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"213⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE214⤵PID:1748
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"215⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE216⤵PID:748
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"217⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE218⤵PID:1688
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"219⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE220⤵PID:1472
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"221⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE222⤵PID:1720
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"223⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE224⤵PID:1516
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"225⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE226⤵PID:1652
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"227⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE228⤵PID:1036
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"229⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE230⤵PID:544
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"231⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE232⤵PID:336
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"233⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE234⤵PID:316
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"235⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE236⤵
- Drops file in Windows directory
PID:1124 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"237⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE238⤵
- Drops file in Windows directory
PID:924 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"239⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE240⤵PID:952
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2C935D~1.EXE"241⤵PID:1132
-