Analysis
-
max time kernel
64s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-05-2022 14:02
Static task
static1
Behavioral task
behavioral1
Sample
d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe
Resource
win10v2004-20220414-en
General
-
Target
d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe
-
Size
3.0MB
-
MD5
3d2d9e5eea086ccf3e0710065bb9d4bb
-
SHA1
0a690bb3d55bdea96cf8c5e2c416a68fdbcff0ef
-
SHA256
d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a
-
SHA512
d39093325004c975cc45aefca5183d7fa836bf18b4a2483606b16e24a162c8b541d3ae6934f34794c1f6d601f4c3928a547d57bc70b316ff900a5f3938e1f004
Malware Config
Signatures
-
Detect Neshta Payload 52 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3582-490\d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe family_neshta C:\Windows\svchost.com family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE family_neshta \Users\Admin\AppData\Local\Temp\3582-490\d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe family_neshta C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE family_neshta C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe family_neshta C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE family_neshta C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe family_neshta C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe family_neshta \PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe family_neshta C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe family_neshta C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE family_neshta \PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe family_neshta C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE family_neshta C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE family_neshta C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE family_neshta C:\Windows\svchost.com family_neshta C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE family_neshta C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE family_neshta \PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE family_neshta C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe family_neshta C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE family_neshta C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE family_neshta C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE family_neshta C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE family_neshta \Users\Admin\AppData\Local\Temp\3582-490\d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exesvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXED0DCAA~1.EXED0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXED0DCAA~1.EXED0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXED0DCAA~1.EXED0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.compid process 844 d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe 1728 svchost.com 1624 D0DCAA~1.EXE 584 svchost.com 1076 D0DCAA~1.EXE 432 svchost.com 964 D0DCAA~1.EXE 544 svchost.com 1464 D0DCAA~1.EXE 1068 svchost.com 836 D0DCAA~1.EXE 1180 svchost.com 1504 D0DCAA~1.EXE 1472 svchost.com 1268 D0DCAA~1.EXE 952 svchost.com 1724 D0DCAA~1.EXE 1948 svchost.com 1976 D0DCAA~1.EXE 1884 svchost.com 360 D0DCAA~1.EXE 1112 svchost.com 1076 D0DCAA~1.EXE 1220 svchost.com 1476 D0DCAA~1.EXE 668 svchost.com 1904 D0DCAA~1.EXE 1888 svchost.com 544 D0DCAA~1.EXE 1996 svchost.com 1956 D0DCAA~1.EXE 800 svchost.com 1208 svchost.com 1224 svchost.com 1616 svchost.com 1048 svchost.com 932 D0DCAA~1.EXE 1216 svchost.com 1524 D0DCAA~1.EXE 528 svchost.com 1608 D0DCAA~1.EXE 1588 svchost.com 280 D0DCAA~1.EXE 520 D0DCAA~1.EXE 1420 D0DCAA~1.EXE 780 svchost.com 1520 D0DCAA~1.EXE 924 svchost.com 1192 D0DCAA~1.EXE 432 svchost.com 1468 D0DCAA~1.EXE 1304 D0DCAA~1.EXE 556 D0DCAA~1.EXE 1740 svchost.com 1280 D0DCAA~1.EXE 624 svchost.com 768 D0DCAA~1.EXE 1208 svchost.com 604 D0DCAA~1.EXE 1616 svchost.com 1496 D0DCAA~1.EXE 1120 svchost.com 1132 D0DCAA~1.EXE 912 svchost.com -
Loads dropped DLL 64 IoCs
Processes:
d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comd0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comD0DCAA~1.EXEsvchost.comsvchost.compid process 1568 d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe 1568 d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe 1728 svchost.com 1728 svchost.com 584 svchost.com 584 svchost.com 432 svchost.com 432 svchost.com 544 svchost.com 544 svchost.com 1568 d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe 1068 svchost.com 1068 svchost.com 844 d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe 844 d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe 844 d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe 844 d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe 1180 svchost.com 1180 svchost.com 844 d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe 1472 svchost.com 1472 svchost.com 844 d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe 952 svchost.com 1568 d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe 952 svchost.com 1948 svchost.com 1948 svchost.com 1568 d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe 844 d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe 1884 svchost.com 1884 svchost.com 844 d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe 844 d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe 844 d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe 1112 svchost.com 1112 svchost.com 844 d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe 1220 svchost.com 1220 svchost.com 668 svchost.com 668 svchost.com 1888 svchost.com 1888 svchost.com 1996 svchost.com 1996 svchost.com 800 svchost.com 800 svchost.com 1224 svchost.com 1224 svchost.com 1048 svchost.com 1048 svchost.com 1216 svchost.com 1216 svchost.com 528 svchost.com 528 svchost.com 1588 svchost.com 1588 svchost.com 520 D0DCAA~1.EXE 520 D0DCAA~1.EXE 780 svchost.com 780 svchost.com 924 svchost.com 924 svchost.com -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exed0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exedescription ioc process File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe -
Drops file in Windows directory 64 IoCs
Processes:
svchost.comsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXED0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXED0DCAA~1.EXED0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXED0DCAA~1.EXEsvchost.comsvchost.comD0DCAA~1.EXED0DCAA~1.EXEsvchost.comD0DCAA~1.EXED0DCAA~1.EXED0DCAA~1.EXED0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXED0DCAA~1.EXED0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXED0DCAA~1.EXED0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comsvchost.comD0DCAA~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comdescription ioc process File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D0DCAA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D0DCAA~1.EXE File opened for modification C:\Windows\directx.sys D0DCAA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com D0DCAA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D0DCAA~1.EXE File opened for modification C:\Windows\directx.sys D0DCAA~1.EXE File opened for modification C:\Windows\directx.sys D0DCAA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D0DCAA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com D0DCAA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys D0DCAA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys D0DCAA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D0DCAA~1.EXE File opened for modification C:\Windows\directx.sys D0DCAA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D0DCAA~1.EXE File opened for modification C:\Windows\svchost.com D0DCAA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com D0DCAA~1.EXE File opened for modification C:\Windows\directx.sys D0DCAA~1.EXE File opened for modification C:\Windows\svchost.com D0DCAA~1.EXE File opened for modification C:\Windows\directx.sys D0DCAA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys D0DCAA~1.EXE File opened for modification C:\Windows\svchost.com D0DCAA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com D0DCAA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys D0DCAA~1.EXE File opened for modification C:\Windows\directx.sys D0DCAA~1.EXE File opened for modification C:\Windows\svchost.com D0DCAA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D0DCAA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys D0DCAA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys D0DCAA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com D0DCAA~1.EXE File opened for modification C:\Windows\directx.sys D0DCAA~1.EXE File opened for modification C:\Windows\svchost.com D0DCAA~1.EXE File opened for modification C:\Windows\svchost.com D0DCAA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys D0DCAA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com D0DCAA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
D0DCAA~1.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main D0DCAA~1.EXE -
Modifies registry class 1 IoCs
Processes:
d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
D0DCAA~1.EXEpid process 2016 D0DCAA~1.EXE 2016 D0DCAA~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exed0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exesvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEsvchost.comD0DCAA~1.EXEdescription pid process target process PID 1568 wrote to memory of 844 1568 d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe PID 1568 wrote to memory of 844 1568 d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe PID 1568 wrote to memory of 844 1568 d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe PID 1568 wrote to memory of 844 1568 d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe PID 844 wrote to memory of 1728 844 d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe svchost.com PID 844 wrote to memory of 1728 844 d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe svchost.com PID 844 wrote to memory of 1728 844 d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe svchost.com PID 844 wrote to memory of 1728 844 d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe svchost.com PID 1728 wrote to memory of 1624 1728 svchost.com D0DCAA~1.EXE PID 1728 wrote to memory of 1624 1728 svchost.com D0DCAA~1.EXE PID 1728 wrote to memory of 1624 1728 svchost.com D0DCAA~1.EXE PID 1728 wrote to memory of 1624 1728 svchost.com D0DCAA~1.EXE PID 1624 wrote to memory of 584 1624 D0DCAA~1.EXE svchost.com PID 1624 wrote to memory of 584 1624 D0DCAA~1.EXE svchost.com PID 1624 wrote to memory of 584 1624 D0DCAA~1.EXE svchost.com PID 1624 wrote to memory of 584 1624 D0DCAA~1.EXE svchost.com PID 584 wrote to memory of 1076 584 svchost.com D0DCAA~1.EXE PID 584 wrote to memory of 1076 584 svchost.com D0DCAA~1.EXE PID 584 wrote to memory of 1076 584 svchost.com D0DCAA~1.EXE PID 584 wrote to memory of 1076 584 svchost.com D0DCAA~1.EXE PID 1076 wrote to memory of 432 1076 D0DCAA~1.EXE svchost.com PID 1076 wrote to memory of 432 1076 D0DCAA~1.EXE svchost.com PID 1076 wrote to memory of 432 1076 D0DCAA~1.EXE svchost.com PID 1076 wrote to memory of 432 1076 D0DCAA~1.EXE svchost.com PID 432 wrote to memory of 964 432 svchost.com D0DCAA~1.EXE PID 432 wrote to memory of 964 432 svchost.com D0DCAA~1.EXE PID 432 wrote to memory of 964 432 svchost.com D0DCAA~1.EXE PID 432 wrote to memory of 964 432 svchost.com D0DCAA~1.EXE PID 964 wrote to memory of 544 964 D0DCAA~1.EXE svchost.com PID 964 wrote to memory of 544 964 D0DCAA~1.EXE svchost.com PID 964 wrote to memory of 544 964 D0DCAA~1.EXE svchost.com PID 964 wrote to memory of 544 964 D0DCAA~1.EXE svchost.com PID 544 wrote to memory of 1464 544 svchost.com D0DCAA~1.EXE PID 544 wrote to memory of 1464 544 svchost.com D0DCAA~1.EXE PID 544 wrote to memory of 1464 544 svchost.com D0DCAA~1.EXE PID 544 wrote to memory of 1464 544 svchost.com D0DCAA~1.EXE PID 1464 wrote to memory of 1068 1464 D0DCAA~1.EXE svchost.com PID 1464 wrote to memory of 1068 1464 D0DCAA~1.EXE svchost.com PID 1464 wrote to memory of 1068 1464 D0DCAA~1.EXE svchost.com PID 1464 wrote to memory of 1068 1464 D0DCAA~1.EXE svchost.com PID 1068 wrote to memory of 836 1068 svchost.com D0DCAA~1.EXE PID 1068 wrote to memory of 836 1068 svchost.com D0DCAA~1.EXE PID 1068 wrote to memory of 836 1068 svchost.com D0DCAA~1.EXE PID 1068 wrote to memory of 836 1068 svchost.com D0DCAA~1.EXE PID 836 wrote to memory of 1180 836 D0DCAA~1.EXE svchost.com PID 836 wrote to memory of 1180 836 D0DCAA~1.EXE svchost.com PID 836 wrote to memory of 1180 836 D0DCAA~1.EXE svchost.com PID 836 wrote to memory of 1180 836 D0DCAA~1.EXE svchost.com PID 1180 wrote to memory of 1504 1180 svchost.com D0DCAA~1.EXE PID 1180 wrote to memory of 1504 1180 svchost.com D0DCAA~1.EXE PID 1180 wrote to memory of 1504 1180 svchost.com D0DCAA~1.EXE PID 1180 wrote to memory of 1504 1180 svchost.com D0DCAA~1.EXE PID 1504 wrote to memory of 1472 1504 D0DCAA~1.EXE svchost.com PID 1504 wrote to memory of 1472 1504 D0DCAA~1.EXE svchost.com PID 1504 wrote to memory of 1472 1504 D0DCAA~1.EXE svchost.com PID 1504 wrote to memory of 1472 1504 D0DCAA~1.EXE svchost.com PID 1472 wrote to memory of 1268 1472 svchost.com D0DCAA~1.EXE PID 1472 wrote to memory of 1268 1472 svchost.com D0DCAA~1.EXE PID 1472 wrote to memory of 1268 1472 svchost.com D0DCAA~1.EXE PID 1472 wrote to memory of 1268 1472 svchost.com D0DCAA~1.EXE PID 1268 wrote to memory of 952 1268 D0DCAA~1.EXE svchost.com PID 1268 wrote to memory of 952 1268 D0DCAA~1.EXE svchost.com PID 1268 wrote to memory of 952 1268 D0DCAA~1.EXE svchost.com PID 1268 wrote to memory of 952 1268 D0DCAA~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe"C:\Users\Admin\AppData\Local\Temp\d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\3582-490\d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\d0dcaa91e51003fa9b9e10980b68f1b11b630ed58d8ceb4ff78befccf381ac5a.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE18⤵
- Executes dropped EXE
PID:1724 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE20⤵
- Executes dropped EXE
PID:1976 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE22⤵
- Executes dropped EXE
PID:360 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE24⤵
- Executes dropped EXE
PID:1076 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE26⤵
- Executes dropped EXE
PID:1476 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:668 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE28⤵
- Executes dropped EXE
PID:1904 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE30⤵
- Executes dropped EXE
PID:544 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE32⤵
- Executes dropped EXE
PID:1956 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE34⤵PID:1208
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE36⤵PID:1616
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE38⤵
- Executes dropped EXE
PID:932 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE40⤵
- Executes dropped EXE
PID:1524 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:528 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE42⤵PID:1608
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE44⤵
- Executes dropped EXE
PID:280 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"45⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE46⤵
- Executes dropped EXE
PID:1420 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:780 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE48⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1520 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE50⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1192 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"51⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE52⤵
- Executes dropped EXE
PID:1468 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"53⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE54⤵
- Executes dropped EXE
PID:556 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"55⤵
- Executes dropped EXE
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE56⤵
- Executes dropped EXE
PID:1280 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"57⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE58⤵
- Executes dropped EXE
PID:768 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"59⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE60⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:604 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"61⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE62⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1496 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"63⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE64⤵
- Executes dropped EXE
PID:1132 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"65⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE66⤵PID:1604
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"67⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE68⤵
- Executes dropped EXE
PID:1608 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"69⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE70⤵
- Drops file in Windows directory
PID:904 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"71⤵
- Drops file in Windows directory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE72⤵
- Executes dropped EXE
- Loads dropped DLL
PID:520 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"73⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE74⤵
- Drops file in Windows directory
PID:812 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"75⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE76⤵PID:468
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"77⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE78⤵PID:284
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"79⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE80⤵PID:1760
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"81⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE82⤵
- Executes dropped EXE
PID:1304 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"83⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE84⤵PID:1100
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"85⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE86⤵PID:1548
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"87⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE88⤵PID:1028
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"89⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE90⤵
- Drops file in Windows directory
PID:296 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"91⤵
- Drops file in Windows directory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE92⤵
- Drops file in Windows directory
PID:1984 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"93⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE94⤵PID:1472
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"95⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE96⤵
- Drops file in Windows directory
PID:1004 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"97⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE98⤵PID:1948
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"99⤵
- Drops file in Windows directory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE100⤵PID:1960
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"101⤵PID:280
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE102⤵PID:1116
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"103⤵
- Drops file in Windows directory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE104⤵PID:780
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"105⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE106⤵PID:924
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"107⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE108⤵PID:1776
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"109⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE110⤵
- Drops file in Windows directory
PID:2040 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"111⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE112⤵PID:1704
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"113⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE114⤵PID:1688
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"115⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE116⤵PID:1184
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"117⤵
- Drops file in Windows directory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE118⤵PID:1068
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"119⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE120⤵PID:1208
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"121⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE122⤵PID:2016
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"123⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE124⤵PID:1216
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"125⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE1⤵PID:1524
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"2⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE3⤵PID:1728
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"4⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE5⤵PID:1588
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"6⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE7⤵
- Drops file in Windows directory
PID:280 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"8⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE9⤵
- Drops file in Windows directory
PID:520 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"10⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE11⤵PID:964
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"12⤵PID:284
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE13⤵PID:1192
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"14⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE15⤵
- Drops file in Windows directory
PID:1952 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"16⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE17⤵PID:2044
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"18⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE19⤵PID:1100
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"20⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE21⤵PID:632
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"22⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE23⤵PID:1028
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"24⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE25⤵PID:1052
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"26⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE27⤵
- Drops file in Windows directory
PID:1144 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"28⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE29⤵PID:1472
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"30⤵
- Drops file in Windows directory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE31⤵PID:528
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"32⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE33⤵PID:592
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"34⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE35⤵PID:1640
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"36⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE37⤵PID:1116
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"38⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE39⤵PID:1220
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"40⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE41⤵
- Drops file in Windows directory
PID:924 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"42⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE43⤵
- Drops file in Windows directory
PID:1896 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"44⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE45⤵PID:1904
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"46⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE47⤵PID:1740
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"48⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE49⤵PID:540
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"50⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE51⤵PID:1184
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"52⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE53⤵
- Drops file in Windows directory
PID:1840 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"54⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE55⤵PID:1696
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"56⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE57⤵PID:1824
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"58⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE59⤵PID:992
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"60⤵
- Drops file in Windows directory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE61⤵PID:1732
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"62⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE63⤵PID:1604
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"64⤵PID:360
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE65⤵PID:1976
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"66⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE67⤵PID:904
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"68⤵
- Drops file in Windows directory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE69⤵PID:832
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"70⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE71⤵PID:316
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"72⤵
- Drops file in Windows directory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE73⤵PID:1744
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"74⤵
- Drops file in Windows directory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE75⤵
- Drops file in Windows directory
PID:688 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"76⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE77⤵PID:1584
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"78⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE79⤵PID:1712
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"80⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE81⤵
- Drops file in Windows directory
PID:836 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"82⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE83⤵PID:604
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"84⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE85⤵PID:1496
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"86⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE87⤵PID:1532
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"88⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE89⤵PID:1180
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"90⤵
- Drops file in Windows directory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE91⤵PID:912
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"92⤵
- Drops file in Windows directory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE93⤵
- Drops file in Windows directory
PID:1720 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"94⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE95⤵PID:360
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"96⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE97⤵PID:1420
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"98⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE99⤵PID:1088
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"100⤵
- Drops file in Windows directory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE101⤵PID:1752
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"102⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE103⤵PID:1300
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"104⤵
- Drops file in Windows directory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE105⤵PID:1904
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"106⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE107⤵PID:1584
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"108⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE109⤵
- Drops file in Windows directory
PID:1712 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"110⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE111⤵PID:632
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"112⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE113⤵PID:1644
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"114⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE115⤵PID:1672
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"116⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE117⤵PID:852
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"118⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE119⤵PID:992
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"120⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE121⤵PID:1612
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"122⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE123⤵PID:1428
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"124⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE125⤵PID:1976
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"126⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE127⤵PID:1112
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"128⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE129⤵PID:832
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"130⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE131⤵
- Drops file in Windows directory
PID:1192 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"132⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE133⤵PID:1704
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"134⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE135⤵PID:2044
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"136⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE137⤵PID:800
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"138⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE139⤵PID:1900
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"140⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE141⤵PID:1840
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"142⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE143⤵PID:1644
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"144⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE145⤵PID:1824
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"146⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE147⤵PID:1004
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"148⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE149⤵PID:1960
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"150⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE151⤵PID:976
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"152⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE153⤵PID:1720
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"154⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE155⤵PID:360
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"156⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE157⤵PID:904
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"158⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE159⤵PID:364
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"160⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE161⤵PID:1416
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"162⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE163⤵PID:556
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"164⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE165⤵PID:1044
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"166⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE167⤵PID:1224
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"168⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE169⤵PID:1008
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"170⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE171⤵PID:700
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"172⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE173⤵
- Drops file in Windows directory
PID:2016 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"174⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE175⤵PID:1268
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"176⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE177⤵PID:1768
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"178⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE179⤵PID:592
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"180⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE181⤵PID:1176
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"182⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE183⤵PID:1720
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"184⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE185⤵PID:1944
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"186⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE187⤵
- Drops file in Windows directory
PID:1896 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"188⤵
- Drops file in Windows directory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE189⤵PID:1476
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"190⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE191⤵PID:1740
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"192⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE193⤵PID:1688
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"194⤵
- Drops file in Windows directory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE195⤵PID:1100
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"196⤵
- Drops file in Windows directory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE197⤵PID:768
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"198⤵
- Drops file in Windows directory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE199⤵PID:1048
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"200⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE201⤵PID:1208
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"202⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE203⤵
- Drops file in Windows directory
PID:956 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"204⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE205⤵
- Drops file in Windows directory
PID:2020 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"206⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE207⤵PID:1524
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"208⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE209⤵PID:580
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"210⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE211⤵PID:1176
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"212⤵
- Drops file in Windows directory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE213⤵PID:1720
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"214⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE215⤵PID:1944
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"216⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE217⤵PID:364
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"218⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE219⤵PID:1416
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"220⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE221⤵PID:556
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"222⤵
- Drops file in Windows directory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE223⤵PID:1044
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"224⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE225⤵PID:1224
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"226⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE227⤵
- Drops file in Windows directory
PID:768 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"228⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE229⤵PID:1900
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"230⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE231⤵PID:1208
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"232⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE233⤵PID:956
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"234⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE235⤵PID:2020
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"236⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE237⤵PID:1960
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"238⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE239⤵PID:780
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE"240⤵
- Drops file in Windows directory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D0DCAA~1.EXE241⤵PID:1176
-