Analysis
-
max time kernel
172s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
01-08-2022 04:31
Static task
static1
Behavioral task
behavioral1
Sample
5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe
Resource
win10v2004-20220721-en
General
-
Target
5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe
-
Size
2.7MB
-
MD5
b7eb659ac366827122e2d6244966eb2d
-
SHA1
4365d5cae42f6ad870aeee57356e105b6cfc8bc6
-
SHA256
5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63
-
SHA512
1fbc2b0086b04a1d31499a5984fadd4e2ea6a4f8a7b017b9b1139ba0e323f1eb9d48d70249341094246adb0693066a399e3b617fd82573cfaff3a3699dee81b6
Malware Config
Signatures
-
Detect Neshta payload 38 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta \Users\Admin\AppData\Local\Temp\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta C:\Users\Admin\AppData\Local\Temp\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta C:\Users\Admin\AppData\Local\Temp\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe family_neshta C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
svchost.exe5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exesvchost.exe5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exesvchost.exe5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exesvchost.com5D0EAE~1.EXEsvchost.com5D0EAE~1.EXE5D0EAE~1.EXE5D0EAE~1.EXEsvchost.com5D0EAE~1.EXEsvchost.com5D0EAE~1.EXEsvchost.comsvchost.comsvchost.com5D0EAE~1.EXE5D0EAE~1.EXE5D0EAE~1.EXEsvchost.com5D0EAE~1.EXEsvchost.comsvchost.com5D0EAE~1.EXE5D0EAE~1.EXEsvchost.com5D0EAE~1.EXE5D0EAE~1.EXEsvchost.com5D0EAE~1.EXE5D0EAE~1.EXEsvchost.com5D0EAE~1.EXEsvchost.com5D0EAE~1.EXEsvchost.com5D0EAE~1.EXEsvchost.comsvchost.com5D0EAE~1.EXEsvchost.com5D0EAE~1.EXEsvchost.com5D0EAE~1.EXEsvchost.com5D0EAE~1.EXEsvchost.com5D0EAE~1.EXE5D0EAE~1.EXEsvchost.comsvchost.com5D0EAE~1.EXEpid process 892 svchost.exe 988 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe 1192 svchost.exe 1928 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe 1908 svchost.exe 1064 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe 1628 svchost.com 1840 5D0EAE~1.EXE 1656 svchost.com 1336 5D0EAE~1.EXE 1704 5D0EAE~1.EXE 1144 5D0EAE~1.EXE 1584 svchost.com 1904 5D0EAE~1.EXE 1360 svchost.com 308 5D0EAE~1.EXE 888 svchost.com 844 svchost.com 1968 svchost.com 1920 5D0EAE~1.EXE 892 5D0EAE~1.EXE 1020 5D0EAE~1.EXE 1236 svchost.com 1300 5D0EAE~1.EXE 1556 svchost.com 1452 svchost.com 336 5D0EAE~1.EXE 108 5D0EAE~1.EXE 1988 svchost.com 524 5D0EAE~1.EXE 1156 5D0EAE~1.EXE 680 svchost.com 276 5D0EAE~1.EXE 1540 5D0EAE~1.EXE 1708 svchost.com 1800 5D0EAE~1.EXE 2044 svchost.com 1036 5D0EAE~1.EXE 1576 svchost.com 1632 5D0EAE~1.EXE 888 svchost.com 844 svchost.com 1940 svchost.com 1920 5D0EAE~1.EXE 1736 svchost.com 1888 5D0EAE~1.EXE 1060 svchost.com 772 5D0EAE~1.EXE 1628 svchost.com 1556 svchost.com 660 svchost.com 580 5D0EAE~1.EXE 1140 svchost.com 976 5D0EAE~1.EXE 1680 svchost.com 1712 5D0EAE~1.EXE 680 svchost.com 1996 5D0EAE~1.EXE 1308 svchost.com 1904 5D0EAE~1.EXE 732 svchost.com 1580 5D0EAE~1.EXE 2044 svchost.com 1036 5D0EAE~1.EXE -
Loads dropped DLL 64 IoCs
Processes:
svchost.exe5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exesvchost.exe5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exesvchost.comsvchost.com5D0EAE~1.EXEsvchost.comsvchost.comsvchost.comsvchost.com5D0EAE~1.EXEsvchost.comsvchost.com5D0EAE~1.EXEsvchost.com5D0EAE~1.EXE5D0EAE~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.compid process 892 svchost.exe 892 svchost.exe 988 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe 988 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe 988 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe 988 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe 1908 svchost.exe 1908 svchost.exe 1064 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe 1064 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe 1628 svchost.com 1628 svchost.com 1656 svchost.com 1656 svchost.com 1704 5D0EAE~1.EXE 1704 5D0EAE~1.EXE 1064 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe 988 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe 1584 svchost.com 1584 svchost.com 1360 svchost.com 1360 svchost.com 888 svchost.com 888 svchost.com 1968 svchost.com 1968 svchost.com 892 5D0EAE~1.EXE 892 5D0EAE~1.EXE 1236 svchost.com 1236 svchost.com 1556 svchost.com 1556 svchost.com 336 5D0EAE~1.EXE 336 5D0EAE~1.EXE 1988 svchost.com 1988 svchost.com 1156 5D0EAE~1.EXE 1156 5D0EAE~1.EXE 276 5D0EAE~1.EXE 276 5D0EAE~1.EXE 1708 svchost.com 1708 svchost.com 2044 svchost.com 2044 svchost.com 1576 svchost.com 1576 svchost.com 888 svchost.com 888 svchost.com 1940 svchost.com 1940 svchost.com 1736 svchost.com 1736 svchost.com 1060 svchost.com 1060 svchost.com 1628 svchost.com 1628 svchost.com 660 svchost.com 660 svchost.com 1140 svchost.com 1140 svchost.com 1680 svchost.com 1680 svchost.com 680 svchost.com 680 svchost.com -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exedescription ioc process File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe -
Drops file in Windows directory 64 IoCs
Processes:
5D0EAE~1.EXEsvchost.com5D0EAE~1.EXEsvchost.com5D0EAE~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com5D0EAE~1.EXE5D0EAE~1.EXE5D0EAE~1.EXE5D0EAE~1.EXEsvchost.com5D0EAE~1.EXE5D0EAE~1.EXE5D0EAE~1.EXE5D0EAE~1.EXE5D0EAE~1.EXE5D0EAE~1.EXE5D0EAE~1.EXEsvchost.com5D0EAE~1.EXEsvchost.comsvchost.com5D0EAE~1.EXEsvchost.comsvchost.com5D0EAE~1.EXE5D0EAE~1.EXE5D0EAE~1.EXEsvchost.com5D0EAE~1.EXE5D0EAE~1.EXEsvchost.com5D0EAE~1.EXEsvchost.comsvchost.comdescription ioc process File opened for modification C:\Windows\directx.sys 5D0EAE~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 5D0EAE~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys 5D0EAE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys 5D0EAE~1.EXE File opened for modification C:\Windows\svchost.com 5D0EAE~1.EXE File opened for modification C:\Windows\directx.sys 5D0EAE~1.EXE File opened for modification C:\Windows\directx.sys 5D0EAE~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 5D0EAE~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys 5D0EAE~1.EXE File opened for modification C:\Windows\directx.sys 5D0EAE~1.EXE File opened for modification C:\Windows\directx.sys 5D0EAE~1.EXE File opened for modification C:\Windows\directx.sys 5D0EAE~1.EXE File opened for modification C:\Windows\directx.sys 5D0EAE~1.EXE File opened for modification C:\Windows\svchost.com 5D0EAE~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com 5D0EAE~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys 5D0EAE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 5D0EAE~1.EXE File opened for modification C:\Windows\directx.sys 5D0EAE~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys 5D0EAE~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 5D0EAE~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com 5D0EAE~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 5D0EAE~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exesvchost.exe5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exesvchost.exe5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exesvchost.com5D0EAE~1.EXEsvchost.com5D0EAE~1.EXE5D0EAE~1.EXE5D0EAE~1.EXEsvchost.com5D0EAE~1.EXEsvchost.com5D0EAE~1.EXEdescription pid process target process PID 1576 wrote to memory of 892 1576 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe svchost.exe PID 1576 wrote to memory of 892 1576 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe svchost.exe PID 1576 wrote to memory of 892 1576 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe svchost.exe PID 1576 wrote to memory of 892 1576 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe svchost.exe PID 892 wrote to memory of 988 892 svchost.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe PID 892 wrote to memory of 988 892 svchost.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe PID 892 wrote to memory of 988 892 svchost.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe PID 892 wrote to memory of 988 892 svchost.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe PID 988 wrote to memory of 1928 988 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe PID 988 wrote to memory of 1928 988 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe PID 988 wrote to memory of 1928 988 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe PID 988 wrote to memory of 1928 988 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe PID 1928 wrote to memory of 1908 1928 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe svchost.exe PID 1928 wrote to memory of 1908 1928 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe svchost.exe PID 1928 wrote to memory of 1908 1928 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe svchost.exe PID 1928 wrote to memory of 1908 1928 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe svchost.exe PID 1908 wrote to memory of 1064 1908 svchost.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe PID 1908 wrote to memory of 1064 1908 svchost.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe PID 1908 wrote to memory of 1064 1908 svchost.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe PID 1908 wrote to memory of 1064 1908 svchost.exe 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe PID 1064 wrote to memory of 1628 1064 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe svchost.com PID 1064 wrote to memory of 1628 1064 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe svchost.com PID 1064 wrote to memory of 1628 1064 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe svchost.com PID 1064 wrote to memory of 1628 1064 5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe svchost.com PID 1628 wrote to memory of 1840 1628 svchost.com 5D0EAE~1.EXE PID 1628 wrote to memory of 1840 1628 svchost.com 5D0EAE~1.EXE PID 1628 wrote to memory of 1840 1628 svchost.com 5D0EAE~1.EXE PID 1628 wrote to memory of 1840 1628 svchost.com 5D0EAE~1.EXE PID 1840 wrote to memory of 1656 1840 5D0EAE~1.EXE svchost.com PID 1840 wrote to memory of 1656 1840 5D0EAE~1.EXE svchost.com PID 1840 wrote to memory of 1656 1840 5D0EAE~1.EXE svchost.com PID 1840 wrote to memory of 1656 1840 5D0EAE~1.EXE svchost.com PID 1656 wrote to memory of 1336 1656 svchost.com 5D0EAE~1.EXE PID 1656 wrote to memory of 1336 1656 svchost.com 5D0EAE~1.EXE PID 1656 wrote to memory of 1336 1656 svchost.com 5D0EAE~1.EXE PID 1656 wrote to memory of 1336 1656 svchost.com 5D0EAE~1.EXE PID 1336 wrote to memory of 1704 1336 5D0EAE~1.EXE 5D0EAE~1.EXE PID 1336 wrote to memory of 1704 1336 5D0EAE~1.EXE 5D0EAE~1.EXE PID 1336 wrote to memory of 1704 1336 5D0EAE~1.EXE 5D0EAE~1.EXE PID 1336 wrote to memory of 1704 1336 5D0EAE~1.EXE 5D0EAE~1.EXE PID 1704 wrote to memory of 1144 1704 5D0EAE~1.EXE 5D0EAE~1.EXE PID 1704 wrote to memory of 1144 1704 5D0EAE~1.EXE 5D0EAE~1.EXE PID 1704 wrote to memory of 1144 1704 5D0EAE~1.EXE 5D0EAE~1.EXE PID 1704 wrote to memory of 1144 1704 5D0EAE~1.EXE 5D0EAE~1.EXE PID 1144 wrote to memory of 1584 1144 5D0EAE~1.EXE svchost.com PID 1144 wrote to memory of 1584 1144 5D0EAE~1.EXE svchost.com PID 1144 wrote to memory of 1584 1144 5D0EAE~1.EXE svchost.com PID 1144 wrote to memory of 1584 1144 5D0EAE~1.EXE svchost.com PID 1584 wrote to memory of 1904 1584 svchost.com 5D0EAE~1.EXE PID 1584 wrote to memory of 1904 1584 svchost.com 5D0EAE~1.EXE PID 1584 wrote to memory of 1904 1584 svchost.com 5D0EAE~1.EXE PID 1584 wrote to memory of 1904 1584 svchost.com 5D0EAE~1.EXE PID 1904 wrote to memory of 1360 1904 5D0EAE~1.EXE svchost.com PID 1904 wrote to memory of 1360 1904 5D0EAE~1.EXE svchost.com PID 1904 wrote to memory of 1360 1904 5D0EAE~1.EXE svchost.com PID 1904 wrote to memory of 1360 1904 5D0EAE~1.EXE svchost.com PID 1360 wrote to memory of 308 1360 svchost.com 5D0EAE~1.EXE PID 1360 wrote to memory of 308 1360 svchost.com 5D0EAE~1.EXE PID 1360 wrote to memory of 308 1360 svchost.com 5D0EAE~1.EXE PID 1360 wrote to memory of 308 1360 svchost.com 5D0EAE~1.EXE PID 308 wrote to memory of 888 308 5D0EAE~1.EXE svchost.com PID 308 wrote to memory of 888 308 5D0EAE~1.EXE svchost.com PID 308 wrote to memory of 888 308 5D0EAE~1.EXE svchost.com PID 308 wrote to memory of 888 308 5D0EAE~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe"C:\Users\Admin\AppData\Local\Temp\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe"C:\Users\Admin\AppData\Local\Temp\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe"3⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\5d0eaecf3ec216327ef1a7161d2d10d8d46365705f8de41aafdab4516ea8ae63.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"7⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE8⤵PID:1556
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:660 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE10⤵PID:580
-
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE9⤵PID:1524
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"10⤵PID:2032
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE10⤵
- Executes dropped EXE
PID:580 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"11⤵PID:1508
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE3⤵
- Executes dropped EXE
PID:1020 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"4⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE5⤵PID:1736
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"6⤵PID:1516
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE2⤵PID:1632
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888
-
-
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
PID:1192
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:336 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"4⤵PID:1524
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:1704
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1584
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵PID:1904
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1360
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:308 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE3⤵PID:844
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE4⤵PID:1992
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"5⤵PID:1536
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵PID:844
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵PID:1920
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:892
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵
- Executes dropped EXE
PID:1300 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:1556
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵PID:1452
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:336
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE2⤵PID:576
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1656
-
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵
- Executes dropped EXE
PID:108 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵
- Executes dropped EXE
PID:524 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:1156
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵PID:680
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:276
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE2⤵
- Executes dropped EXE
PID:1996 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"3⤵
- Executes dropped EXE
PID:1308
-
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵
- Executes dropped EXE
PID:1540 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵PID:1036
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"1⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE2⤵PID:1036
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"3⤵PID:1600
-
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵
- Executes dropped EXE
PID:1920 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵
- Executes dropped EXE
PID:1800
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵
- Executes dropped EXE
PID:1888 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵
- Executes dropped EXE
PID:772 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1628
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵
- Executes dropped EXE
PID:1712 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:680
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE3⤵PID:1580
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044
-
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE3⤵
- Executes dropped EXE
PID:1580 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"4⤵PID:820
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵
- Executes dropped EXE
PID:1632 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:1964
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵PID:1228
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:240
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵PID:1048
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:2020
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:1436
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵PID:1756
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:1448
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵PID:856
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:2012
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵
- Drops file in Windows directory
PID:568 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵PID:1296
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:1140
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵
- Executes dropped EXE
PID:976 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:436
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵PID:840
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:1944
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵PID:268
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:1544
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵PID:1604
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:1016
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE2⤵PID:2008
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"3⤵PID:948
-
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵PID:1976
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵
- Executes dropped EXE
PID:732
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵PID:944
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:1280
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵PID:1592
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵
- Executes dropped EXE
PID:844
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵PID:996
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:2028
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵PID:1796
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵PID:1668
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵
- Executes dropped EXE
PID:1452
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:1676
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:1488
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:276 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:1612
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵PID:1004
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:1604
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵PID:1832
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵
- Drops file in Windows directory
PID:1924
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE1⤵
- Executes dropped EXE
PID:1036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"2⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE3⤵PID:2004
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"4⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE5⤵PID:1684
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"6⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE7⤵PID:1536
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"8⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE9⤵PID:2028
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"10⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE11⤵PID:1756
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"12⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE13⤵PID:1628
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"14⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE15⤵PID:2012
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"16⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE17⤵PID:336
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"18⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE19⤵PID:1532
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"20⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE21⤵PID:852
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"22⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE23⤵PID:1068
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"24⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE25⤵PID:1748
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"26⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE27⤵PID:1016
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"28⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE29⤵PID:692
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"30⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE31⤵PID:980
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"32⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE33⤵PID:1936
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"34⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE35⤵PID:1228
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"36⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE37⤵PID:996
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"38⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE39⤵PID:1300
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"40⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE41⤵PID:1236
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"42⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE43⤵PID:1516
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"44⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE45⤵PID:1840
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"46⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE47⤵PID:1772
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"48⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE49⤵PID:1660
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"50⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE51⤵PID:1296
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"52⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE53⤵PID:840
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"54⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE55⤵PID:268
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"56⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE57⤵PID:1584
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"58⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE59⤵PID:1976
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"60⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE61⤵
- Drops file in Windows directory
PID:1580 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"62⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE63⤵PID:692
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"64⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE65⤵PID:980
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"66⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE67⤵
- Drops file in Windows directory
PID:1036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"68⤵
- Drops file in Windows directory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE69⤵PID:1968
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"70⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE71⤵PID:920
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"72⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE73⤵PID:1300
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"74⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE75⤵PID:1236
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"76⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE77⤵PID:1516
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"78⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE79⤵PID:576
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"80⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE81⤵PID:1484
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"82⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE83⤵PID:1140
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"84⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE85⤵PID:852
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"86⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE87⤵PID:1156
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"88⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE89⤵
- Drops file in Windows directory
PID:276 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"90⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE91⤵PID:1544
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"92⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE93⤵PID:1356
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"94⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE95⤵PID:944
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"96⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE97⤵PID:1632
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"98⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE99⤵PID:1964
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"100⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE101⤵PID:1968
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"102⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE103⤵PID:892
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"104⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE105⤵PID:568
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"106⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE107⤵PID:660
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"108⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE109⤵PID:1988
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"110⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE111⤵PID:580
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"112⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE113⤵PID:1336
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"114⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE115⤵PID:1144
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"116⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE117⤵PID:680
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"118⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE119⤵PID:1308
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"120⤵
- Drops file in Windows directory
PID:320 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE121⤵PID:1904
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5D0EAE~1.EXE"122⤵PID:1360
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-