Analysis
-
max time kernel
227s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 08:03
Static task
static1
Behavioral task
behavioral1
Sample
fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe
Resource
win10v2004-20220901-en
General
-
Target
fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe
-
Size
703KB
-
MD5
90cd738e2ab584ae9f1faa6641d1c4ff
-
SHA1
3b080867bc85e39b8d3606b7e6f9d4c72b5bd535
-
SHA256
fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd
-
SHA512
ed1b2e27087cd38c02310f84a9a700741165f82aad18a10aad53eebda1ec2890df2747a02ea51bc1ab96362ac4478f07e9804898f769ab0045bfc868a3be0328
-
SSDEEP
12288:zzQWAhaVQFipAkaDM3FH5Pd8RV82NGC4iPh170xiWMgFxJx9dZTO6CW:zsWAhaVQFTct5PHC4iPsVMihOm
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exesvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.compid process 1320 fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe 324 svchost.com 336 FEAD52~1.EXE 1844 svchost.com 1552 FEAD52~1.EXE 436 svchost.com 1044 FEAD52~1.EXE 1840 svchost.com 1936 FEAD52~1.EXE 1252 svchost.com 1800 FEAD52~1.EXE 1364 svchost.com 1732 FEAD52~1.EXE 908 svchost.com 1496 FEAD52~1.EXE 472 svchost.com 396 FEAD52~1.EXE 1888 svchost.com 668 FEAD52~1.EXE 540 svchost.com 1724 FEAD52~1.EXE 940 svchost.com 1952 FEAD52~1.EXE 844 svchost.com 1960 FEAD52~1.EXE 1568 svchost.com 1840 FEAD52~1.EXE 800 svchost.com 1220 FEAD52~1.EXE 568 svchost.com 1720 FEAD52~1.EXE 976 svchost.com 1364 FEAD52~1.EXE 1644 svchost.com 580 FEAD52~1.EXE 1352 svchost.com 1788 FEAD52~1.EXE 1704 svchost.com 472 FEAD52~1.EXE 396 svchost.com 1836 FEAD52~1.EXE 2004 svchost.com 1088 FEAD52~1.EXE 1784 svchost.com 1776 FEAD52~1.EXE 1912 svchost.com 1328 FEAD52~1.EXE 1256 svchost.com 112 FEAD52~1.EXE 1356 svchost.com 1568 FEAD52~1.EXE 1252 svchost.com 692 FEAD52~1.EXE 1280 svchost.com 1964 FEAD52~1.EXE 2040 svchost.com 976 FEAD52~1.EXE 564 svchost.com 1372 FEAD52~1.EXE 680 svchost.com 1740 FEAD52~1.EXE 872 svchost.com 324 FEAD52~1.EXE 1628 svchost.com -
Loads dropped DLL 64 IoCs
Processes:
fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.compid process 700 fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe 700 fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe 324 svchost.com 324 svchost.com 1844 svchost.com 1844 svchost.com 436 svchost.com 436 svchost.com 1840 svchost.com 1840 svchost.com 1252 svchost.com 1252 svchost.com 1364 svchost.com 1364 svchost.com 908 svchost.com 908 svchost.com 472 svchost.com 472 svchost.com 1888 svchost.com 1888 svchost.com 540 svchost.com 540 svchost.com 940 svchost.com 940 svchost.com 844 svchost.com 844 svchost.com 1568 svchost.com 1568 svchost.com 800 svchost.com 800 svchost.com 568 svchost.com 568 svchost.com 976 svchost.com 976 svchost.com 1644 svchost.com 1644 svchost.com 1352 svchost.com 1352 svchost.com 1704 svchost.com 1704 svchost.com 396 svchost.com 396 svchost.com 2004 svchost.com 2004 svchost.com 1784 svchost.com 1784 svchost.com 1912 svchost.com 1912 svchost.com 1256 svchost.com 1256 svchost.com 1356 svchost.com 1356 svchost.com 1252 svchost.com 1252 svchost.com 1280 svchost.com 1280 svchost.com 2040 svchost.com 2040 svchost.com 564 svchost.com 564 svchost.com 680 svchost.com 680 svchost.com 872 svchost.com 872 svchost.com -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exefead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exedescription ioc process File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe -
Drops file in Windows directory 64 IoCs
Processes:
FEAD52~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comFEAD52~1.EXEsvchost.comsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comsvchost.comsvchost.comFEAD52~1.EXEFEAD52~1.EXEFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comsvchost.comsvchost.comFEAD52~1.EXEFEAD52~1.EXEFEAD52~1.EXEFEAD52~1.EXEsvchost.comFEAD52~1.EXEdescription ioc process File opened for modification C:\Windows\svchost.com FEAD52~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys FEAD52~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com FEAD52~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys FEAD52~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com FEAD52~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com FEAD52~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com FEAD52~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com FEAD52~1.EXE File opened for modification C:\Windows\svchost.com FEAD52~1.EXE File opened for modification C:\Windows\directx.sys FEAD52~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys FEAD52~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com FEAD52~1.EXE File opened for modification C:\Windows\directx.sys FEAD52~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com FEAD52~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys FEAD52~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com FEAD52~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 31 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe nsis_installer_2 -
Modifies registry class 1 IoCs
Processes:
fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exefead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exesvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEsvchost.comFEAD52~1.EXEdescription pid process target process PID 700 wrote to memory of 1320 700 fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe PID 700 wrote to memory of 1320 700 fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe PID 700 wrote to memory of 1320 700 fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe PID 700 wrote to memory of 1320 700 fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe PID 1320 wrote to memory of 324 1320 fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe svchost.com PID 1320 wrote to memory of 324 1320 fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe svchost.com PID 1320 wrote to memory of 324 1320 fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe svchost.com PID 1320 wrote to memory of 324 1320 fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe svchost.com PID 324 wrote to memory of 336 324 svchost.com FEAD52~1.EXE PID 324 wrote to memory of 336 324 svchost.com FEAD52~1.EXE PID 324 wrote to memory of 336 324 svchost.com FEAD52~1.EXE PID 324 wrote to memory of 336 324 svchost.com FEAD52~1.EXE PID 336 wrote to memory of 1844 336 FEAD52~1.EXE svchost.com PID 336 wrote to memory of 1844 336 FEAD52~1.EXE svchost.com PID 336 wrote to memory of 1844 336 FEAD52~1.EXE svchost.com PID 336 wrote to memory of 1844 336 FEAD52~1.EXE svchost.com PID 1844 wrote to memory of 1552 1844 svchost.com FEAD52~1.EXE PID 1844 wrote to memory of 1552 1844 svchost.com FEAD52~1.EXE PID 1844 wrote to memory of 1552 1844 svchost.com FEAD52~1.EXE PID 1844 wrote to memory of 1552 1844 svchost.com FEAD52~1.EXE PID 1552 wrote to memory of 436 1552 FEAD52~1.EXE svchost.com PID 1552 wrote to memory of 436 1552 FEAD52~1.EXE svchost.com PID 1552 wrote to memory of 436 1552 FEAD52~1.EXE svchost.com PID 1552 wrote to memory of 436 1552 FEAD52~1.EXE svchost.com PID 436 wrote to memory of 1044 436 svchost.com FEAD52~1.EXE PID 436 wrote to memory of 1044 436 svchost.com FEAD52~1.EXE PID 436 wrote to memory of 1044 436 svchost.com FEAD52~1.EXE PID 436 wrote to memory of 1044 436 svchost.com FEAD52~1.EXE PID 1044 wrote to memory of 1840 1044 FEAD52~1.EXE svchost.com PID 1044 wrote to memory of 1840 1044 FEAD52~1.EXE svchost.com PID 1044 wrote to memory of 1840 1044 FEAD52~1.EXE svchost.com PID 1044 wrote to memory of 1840 1044 FEAD52~1.EXE svchost.com PID 1840 wrote to memory of 1936 1840 svchost.com FEAD52~1.EXE PID 1840 wrote to memory of 1936 1840 svchost.com FEAD52~1.EXE PID 1840 wrote to memory of 1936 1840 svchost.com FEAD52~1.EXE PID 1840 wrote to memory of 1936 1840 svchost.com FEAD52~1.EXE PID 1936 wrote to memory of 1252 1936 FEAD52~1.EXE svchost.com PID 1936 wrote to memory of 1252 1936 FEAD52~1.EXE svchost.com PID 1936 wrote to memory of 1252 1936 FEAD52~1.EXE svchost.com PID 1936 wrote to memory of 1252 1936 FEAD52~1.EXE svchost.com PID 1252 wrote to memory of 1800 1252 svchost.com FEAD52~1.EXE PID 1252 wrote to memory of 1800 1252 svchost.com FEAD52~1.EXE PID 1252 wrote to memory of 1800 1252 svchost.com FEAD52~1.EXE PID 1252 wrote to memory of 1800 1252 svchost.com FEAD52~1.EXE PID 1800 wrote to memory of 1364 1800 FEAD52~1.EXE svchost.com PID 1800 wrote to memory of 1364 1800 FEAD52~1.EXE svchost.com PID 1800 wrote to memory of 1364 1800 FEAD52~1.EXE svchost.com PID 1800 wrote to memory of 1364 1800 FEAD52~1.EXE svchost.com PID 1364 wrote to memory of 1732 1364 svchost.com FEAD52~1.EXE PID 1364 wrote to memory of 1732 1364 svchost.com FEAD52~1.EXE PID 1364 wrote to memory of 1732 1364 svchost.com FEAD52~1.EXE PID 1364 wrote to memory of 1732 1364 svchost.com FEAD52~1.EXE PID 1732 wrote to memory of 908 1732 FEAD52~1.EXE svchost.com PID 1732 wrote to memory of 908 1732 FEAD52~1.EXE svchost.com PID 1732 wrote to memory of 908 1732 FEAD52~1.EXE svchost.com PID 1732 wrote to memory of 908 1732 FEAD52~1.EXE svchost.com PID 908 wrote to memory of 1496 908 svchost.com FEAD52~1.EXE PID 908 wrote to memory of 1496 908 svchost.com FEAD52~1.EXE PID 908 wrote to memory of 1496 908 svchost.com FEAD52~1.EXE PID 908 wrote to memory of 1496 908 svchost.com FEAD52~1.EXE PID 1496 wrote to memory of 472 1496 FEAD52~1.EXE svchost.com PID 1496 wrote to memory of 472 1496 FEAD52~1.EXE svchost.com PID 1496 wrote to memory of 472 1496 FEAD52~1.EXE svchost.com PID 1496 wrote to memory of 472 1496 FEAD52~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe"C:\Users\Admin\AppData\Local\Temp\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\fead52266337c7c1ce34e160069973673c3c5932b3588f06f0c6b014c0cb78dd.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:472 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE18⤵
- Executes dropped EXE
PID:396 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE20⤵
- Executes dropped EXE
PID:668 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE22⤵
- Executes dropped EXE
PID:1724 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE24⤵
- Executes dropped EXE
PID:1952 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE26⤵
- Executes dropped EXE
PID:1960 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE28⤵
- Executes dropped EXE
PID:1840 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:800 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE30⤵
- Executes dropped EXE
PID:1220 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE32⤵
- Executes dropped EXE
PID:1720 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:976 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE34⤵
- Executes dropped EXE
PID:1364 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE36⤵
- Executes dropped EXE
PID:580 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE38⤵
- Executes dropped EXE
PID:1788 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE40⤵
- Executes dropped EXE
PID:472 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:396 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE42⤵
- Executes dropped EXE
PID:1836 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE44⤵
- Executes dropped EXE
PID:1088 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE46⤵
- Executes dropped EXE
PID:1776 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE48⤵
- Executes dropped EXE
PID:1328 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE50⤵
- Executes dropped EXE
PID:112 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE52⤵
- Executes dropped EXE
PID:1568 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE54⤵
- Executes dropped EXE
PID:692 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE56⤵
- Executes dropped EXE
PID:1964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE58⤵
- Executes dropped EXE
PID:976 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE1⤵
- Executes dropped EXE
PID:1372 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE3⤵
- Executes dropped EXE
PID:1740 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE5⤵
- Executes dropped EXE
PID:324 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"6⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE7⤵PID:296
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"8⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE9⤵PID:1988
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"10⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE11⤵PID:1956
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"12⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE13⤵PID:824
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"14⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE15⤵PID:552
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"16⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE17⤵PID:112
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"18⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE19⤵PID:1544
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"20⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE21⤵PID:1164
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"22⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE23⤵PID:1040
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"24⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE16⤵PID:1768
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"17⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE18⤵PID:1516
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"19⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE20⤵PID:1912
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"21⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE22⤵PID:1960
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"23⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE24⤵PID:800
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"25⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE26⤵PID:568
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"27⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE28⤵PID:908
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"29⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE30⤵PID:1092
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"31⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE32⤵PID:636
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"33⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE34⤵PID:1988
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"35⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE36⤵PID:1584
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"37⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE38⤵PID:1656
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"39⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE40⤵PID:536
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"41⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE42⤵PID:1956
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"43⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE44⤵PID:552
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"45⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE46⤵PID:1516
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"47⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE48⤵PID:1260
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"49⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE50⤵PID:1544
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"51⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE52⤵PID:616
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"53⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE54⤵PID:1632
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"55⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE56⤵PID:516
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"57⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE58⤵PID:1644
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"59⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE60⤵PID:900
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"61⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE62⤵PID:1216
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"63⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE64⤵PID:316
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"65⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE66⤵PID:1972
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"67⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE68⤵PID:296
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"69⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE70⤵PID:1748
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"71⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE72⤵
- Drops file in Windows directory
PID:1984 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"73⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE74⤵
- Drops file in Windows directory
PID:320 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"75⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE76⤵PID:1576
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"77⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE78⤵PID:112
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"79⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE80⤵PID:1544
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"81⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE82⤵PID:1496
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"83⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE84⤵PID:1384
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"85⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE86⤵PID:1572
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"87⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE88⤵PID:872
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"89⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE90⤵PID:1128
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"91⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE92⤵PID:1088
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"93⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE94⤵PID:1584
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"95⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE96⤵
- Drops file in Windows directory
PID:396 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"97⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE98⤵PID:1684
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"99⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE100⤵PID:436
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"101⤵
- Drops file in Windows directory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE102⤵PID:524
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"103⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE104⤵PID:1516
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"105⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE106⤵PID:1364
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"107⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE108⤵PID:1752
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"109⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE110⤵PID:1280
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"111⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE112⤵PID:680
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"113⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE114⤵PID:564
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"115⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE116⤵PID:1580
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"117⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE118⤵PID:1832
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"119⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE120⤵PID:780
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"121⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE122⤵PID:2020
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"123⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE124⤵PID:1724
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"125⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE126⤵PID:396
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"127⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE128⤵PID:1684
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"129⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE130⤵PID:1356
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"131⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE132⤵PID:320
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"133⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE134⤵PID:1516
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"135⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE136⤵PID:1364
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"137⤵
- Drops file in Windows directory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE138⤵PID:800
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"139⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE140⤵PID:692
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"141⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE142⤵PID:2040
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"143⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE144⤵PID:1092
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"145⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE146⤵PID:472
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"147⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE148⤵PID:1108
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"149⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE150⤵PID:980
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"151⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE152⤵PID:536
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"153⤵
- Drops file in Windows directory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE154⤵PID:1784
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"155⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE156⤵PID:540
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"157⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE158⤵PID:436
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"159⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE160⤵PID:1296
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"161⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE162⤵
- Drops file in Windows directory
PID:112 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"163⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE164⤵PID:1964
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"165⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE166⤵PID:1372
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"167⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE168⤵PID:1640
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"169⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE170⤵PID:516
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"171⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE172⤵PID:1644
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"173⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE174⤵PID:1740
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"175⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE176⤵PID:1836
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"177⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE178⤵PID:336
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"179⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE180⤵PID:2020
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"181⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE182⤵PID:1956
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"183⤵PID:188
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE184⤵PID:1908
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"185⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE186⤵PID:1356
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"187⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE188⤵PID:1840
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"189⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE190⤵PID:1952
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"191⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE192⤵PID:836
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"193⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE194⤵PID:1800
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"195⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE196⤵PID:1280
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"197⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE198⤵
- Drops file in Windows directory
PID:852 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"199⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE200⤵PID:1040
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"201⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE202⤵PID:1580
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"203⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE204⤵PID:580
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"205⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE206⤵PID:1676
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"207⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE208⤵PID:536
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"209⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE210⤵PID:1972
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"211⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE212⤵PID:540
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"213⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE214⤵PID:436
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"215⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE216⤵PID:1296
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"217⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE218⤵PID:1440
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"219⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE220⤵PID:1904
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"221⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE222⤵
- Drops file in Windows directory
PID:1752 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"223⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE224⤵PID:908
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"225⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE226⤵PID:1504
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"227⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE228⤵PID:636
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"229⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE230⤵PID:1692
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"231⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE232⤵PID:1836
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"233⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE234⤵PID:824
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"235⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE236⤵PID:324
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"237⤵
- Drops file in Windows directory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE238⤵PID:2020
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"239⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE240⤵PID:280
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FEAD52~1.EXE"241⤵PID:1456
-