Analysis
-
max time kernel
156s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 08:05
Behavioral task
behavioral1
Sample
1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe
Resource
win10v2004-20220812-en
General
-
Target
1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe
-
Size
529KB
-
MD5
3de6dca5d1f5c9342fea95df56d2dfd8
-
SHA1
381069749fb634e13106fe8ddc544ee66bece55c
-
SHA256
1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805
-
SHA512
4283c69f952eeede80081369d42c89b2ec9f7277bd00537198789babb0ebbf66e9e3d41433f7512439781f516817c220d5972f7f189db5d567e712fe41856819
-
SSDEEP
6144:k99SrhvEkFuuS5g3Dgbh7/VL4EU+/DZOvQR4gDnD4siGEPkY+Eh5j499:DrBEkf30pp4iDogvMGEPkE5j
Malware Config
Signatures
-
Detect Neshta payload 48 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE family_neshta C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe family_neshta \PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE family_neshta C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe family_neshta \PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exesvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.compid process 2000 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe 1972 svchost.com 1980 1DED4B~1.EXE 1020 svchost.com 888 1DED4B~1.EXE 1948 svchost.com 1740 1DED4B~1.EXE 1696 svchost.com 1192 1DED4B~1.EXE 1700 svchost.com 756 1DED4B~1.EXE 364 svchost.com 1724 1DED4B~1.EXE 1260 svchost.com 1452 1DED4B~1.EXE 1460 svchost.com 1624 1DED4B~1.EXE 1956 svchost.com 1716 1DED4B~1.EXE 1136 svchost.com 1828 1DED4B~1.EXE 1876 svchost.com 1664 1DED4B~1.EXE 2036 svchost.com 696 1DED4B~1.EXE 856 svchost.com 420 1DED4B~1.EXE 1528 svchost.com 1820 1DED4B~1.EXE 1168 svchost.com 1620 1DED4B~1.EXE 2040 svchost.com 756 1DED4B~1.EXE 1888 svchost.com 560 1DED4B~1.EXE 1524 svchost.com 1380 1DED4B~1.EXE 1896 svchost.com 1604 1DED4B~1.EXE 1640 svchost.com 1596 1DED4B~1.EXE 996 svchost.com 740 1DED4B~1.EXE 1968 svchost.com 1956 1DED4B~1.EXE 1980 svchost.com 1976 1DED4B~1.EXE 1480 svchost.com 1668 1DED4B~1.EXE 1184 svchost.com 2036 1DED4B~1.EXE 1128 svchost.com 1116 1DED4B~1.EXE 1908 svchost.com 580 1DED4B~1.EXE 1208 svchost.com 628 1DED4B~1.EXE 840 svchost.com 1396 1DED4B~1.EXE 1056 svchost.com 432 1DED4B~1.EXE 1064 svchost.com 1524 1DED4B~1.EXE 760 svchost.com -
Loads dropped DLL 64 IoCs
Processes:
1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.compid process 960 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe 960 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe 1972 svchost.com 1972 svchost.com 1020 svchost.com 1020 svchost.com 1948 svchost.com 1948 svchost.com 1696 svchost.com 1696 svchost.com 1700 svchost.com 1700 svchost.com 364 svchost.com 364 svchost.com 1260 svchost.com 1260 svchost.com 1460 svchost.com 960 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe 2000 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe 1460 svchost.com 960 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe 960 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe 1956 svchost.com 1956 svchost.com 960 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe 1136 svchost.com 1136 svchost.com 1876 svchost.com 1876 svchost.com 960 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe 2036 svchost.com 2036 svchost.com 960 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe 2000 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe 856 svchost.com 856 svchost.com 1528 svchost.com 1528 svchost.com 1168 svchost.com 1168 svchost.com 2040 svchost.com 2040 svchost.com 960 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe 1888 svchost.com 1888 svchost.com 1524 svchost.com 1524 svchost.com 1896 svchost.com 1896 svchost.com 1640 svchost.com 1640 svchost.com 996 svchost.com 996 svchost.com 1968 svchost.com 1968 svchost.com 1980 svchost.com 1980 svchost.com 1480 svchost.com 1480 svchost.com 960 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe 1184 svchost.com 1184 svchost.com 960 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe 1128 svchost.com -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exedescription ioc process File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe -
Drops file in Windows directory 64 IoCs
Processes:
svchost.comsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXE1DED4B~1.EXE1DED4B~1.EXEsvchost.comsvchost.com1DED4B~1.EXE1DED4B~1.EXEsvchost.comsvchost.com1DED4B~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com1DED4B~1.EXE1DED4B~1.EXEsvchost.comsvchost.comsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXE1DED4B~1.EXE1DED4B~1.EXEsvchost.comsvchost.com1DED4B~1.EXEsvchost.comsvchost.comsvchost.com1DED4B~1.EXE1DED4B~1.EXE1DED4B~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com1DED4B~1.EXEsvchost.comdescription ioc process File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 1DED4B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com 1DED4B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 1DED4B~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com 1DED4B~1.EXE File opened for modification C:\Windows\svchost.com 1DED4B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 1DED4B~1.EXE File opened for modification C:\Windows\svchost.com 1DED4B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 1DED4B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 1DED4B~1.EXE File opened for modification C:\Windows\svchost.com 1DED4B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 1DED4B~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 1DED4B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 1DED4B~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys 1DED4B~1.EXE File opened for modification C:\Windows\svchost.com 1DED4B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 1DED4B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 1DED4B~1.EXE File opened for modification C:\Windows\svchost.com 1DED4B~1.EXE File opened for modification C:\Windows\svchost.com 1DED4B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 1DED4B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
pid process 1124 1124 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exesvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEsvchost.com1DED4B~1.EXEdescription pid process target process PID 960 wrote to memory of 2000 960 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe PID 960 wrote to memory of 2000 960 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe PID 960 wrote to memory of 2000 960 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe PID 960 wrote to memory of 2000 960 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe PID 2000 wrote to memory of 1972 2000 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe svchost.com PID 2000 wrote to memory of 1972 2000 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe svchost.com PID 2000 wrote to memory of 1972 2000 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe svchost.com PID 2000 wrote to memory of 1972 2000 1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe svchost.com PID 1972 wrote to memory of 1980 1972 svchost.com 1DED4B~1.EXE PID 1972 wrote to memory of 1980 1972 svchost.com 1DED4B~1.EXE PID 1972 wrote to memory of 1980 1972 svchost.com 1DED4B~1.EXE PID 1972 wrote to memory of 1980 1972 svchost.com 1DED4B~1.EXE PID 1980 wrote to memory of 1020 1980 1DED4B~1.EXE svchost.com PID 1980 wrote to memory of 1020 1980 1DED4B~1.EXE svchost.com PID 1980 wrote to memory of 1020 1980 1DED4B~1.EXE svchost.com PID 1980 wrote to memory of 1020 1980 1DED4B~1.EXE svchost.com PID 1020 wrote to memory of 888 1020 svchost.com 1DED4B~1.EXE PID 1020 wrote to memory of 888 1020 svchost.com 1DED4B~1.EXE PID 1020 wrote to memory of 888 1020 svchost.com 1DED4B~1.EXE PID 1020 wrote to memory of 888 1020 svchost.com 1DED4B~1.EXE PID 888 wrote to memory of 1948 888 1DED4B~1.EXE svchost.com PID 888 wrote to memory of 1948 888 1DED4B~1.EXE svchost.com PID 888 wrote to memory of 1948 888 1DED4B~1.EXE svchost.com PID 888 wrote to memory of 1948 888 1DED4B~1.EXE svchost.com PID 1948 wrote to memory of 1740 1948 svchost.com 1DED4B~1.EXE PID 1948 wrote to memory of 1740 1948 svchost.com 1DED4B~1.EXE PID 1948 wrote to memory of 1740 1948 svchost.com 1DED4B~1.EXE PID 1948 wrote to memory of 1740 1948 svchost.com 1DED4B~1.EXE PID 1740 wrote to memory of 1696 1740 1DED4B~1.EXE svchost.com PID 1740 wrote to memory of 1696 1740 1DED4B~1.EXE svchost.com PID 1740 wrote to memory of 1696 1740 1DED4B~1.EXE svchost.com PID 1740 wrote to memory of 1696 1740 1DED4B~1.EXE svchost.com PID 1696 wrote to memory of 1192 1696 svchost.com 1DED4B~1.EXE PID 1696 wrote to memory of 1192 1696 svchost.com 1DED4B~1.EXE PID 1696 wrote to memory of 1192 1696 svchost.com 1DED4B~1.EXE PID 1696 wrote to memory of 1192 1696 svchost.com 1DED4B~1.EXE PID 1192 wrote to memory of 1700 1192 1DED4B~1.EXE svchost.com PID 1192 wrote to memory of 1700 1192 1DED4B~1.EXE svchost.com PID 1192 wrote to memory of 1700 1192 1DED4B~1.EXE svchost.com PID 1192 wrote to memory of 1700 1192 1DED4B~1.EXE svchost.com PID 1700 wrote to memory of 756 1700 svchost.com 1DED4B~1.EXE PID 1700 wrote to memory of 756 1700 svchost.com 1DED4B~1.EXE PID 1700 wrote to memory of 756 1700 svchost.com 1DED4B~1.EXE PID 1700 wrote to memory of 756 1700 svchost.com 1DED4B~1.EXE PID 756 wrote to memory of 364 756 1DED4B~1.EXE svchost.com PID 756 wrote to memory of 364 756 1DED4B~1.EXE svchost.com PID 756 wrote to memory of 364 756 1DED4B~1.EXE svchost.com PID 756 wrote to memory of 364 756 1DED4B~1.EXE svchost.com PID 364 wrote to memory of 1724 364 svchost.com 1DED4B~1.EXE PID 364 wrote to memory of 1724 364 svchost.com 1DED4B~1.EXE PID 364 wrote to memory of 1724 364 svchost.com 1DED4B~1.EXE PID 364 wrote to memory of 1724 364 svchost.com 1DED4B~1.EXE PID 1724 wrote to memory of 1260 1724 1DED4B~1.EXE svchost.com PID 1724 wrote to memory of 1260 1724 1DED4B~1.EXE svchost.com PID 1724 wrote to memory of 1260 1724 1DED4B~1.EXE svchost.com PID 1724 wrote to memory of 1260 1724 1DED4B~1.EXE svchost.com PID 1260 wrote to memory of 1452 1260 svchost.com 1DED4B~1.EXE PID 1260 wrote to memory of 1452 1260 svchost.com 1DED4B~1.EXE PID 1260 wrote to memory of 1452 1260 svchost.com 1DED4B~1.EXE PID 1260 wrote to memory of 1452 1260 svchost.com 1DED4B~1.EXE PID 1452 wrote to memory of 1460 1452 1DED4B~1.EXE svchost.com PID 1452 wrote to memory of 1460 1452 1DED4B~1.EXE svchost.com PID 1452 wrote to memory of 1460 1452 1DED4B~1.EXE svchost.com PID 1452 wrote to memory of 1460 1452 1DED4B~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe"C:\Users\Admin\AppData\Local\Temp\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\1ded4b8b6f819f6dd03bbebb97462fc802bafd71780fa6126ed2a3a024030805.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE18⤵
- Executes dropped EXE
PID:1624 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE20⤵
- Executes dropped EXE
PID:1716 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE22⤵
- Executes dropped EXE
PID:1828 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE24⤵
- Executes dropped EXE
PID:1664 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE26⤵
- Executes dropped EXE
PID:696 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE28⤵
- Executes dropped EXE
PID:420 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE30⤵
- Executes dropped EXE
PID:1820 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE32⤵
- Executes dropped EXE
PID:1620 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE34⤵
- Executes dropped EXE
PID:756 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE36⤵
- Executes dropped EXE
PID:560 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE38⤵
- Executes dropped EXE
PID:1380 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE40⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1604 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE42⤵
- Executes dropped EXE
PID:1596 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE44⤵
- Executes dropped EXE
PID:740 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE46⤵
- Executes dropped EXE
PID:1956 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE48⤵
- Executes dropped EXE
PID:1976 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE50⤵
- Executes dropped EXE
PID:1668 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE52⤵
- Executes dropped EXE
PID:2036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE54⤵
- Executes dropped EXE
PID:1116 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"55⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE56⤵
- Executes dropped EXE
PID:580 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"57⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE58⤵
- Executes dropped EXE
PID:628 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"59⤵
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE60⤵
- Executes dropped EXE
PID:1396 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"61⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE62⤵
- Executes dropped EXE
PID:432 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"63⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE64⤵
- Executes dropped EXE
PID:1524 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"65⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE66⤵PID:1068
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"67⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE68⤵PID:1592
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"69⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE70⤵PID:1992
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"71⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE72⤵PID:1988
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"73⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE74⤵PID:288
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"75⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE76⤵PID:1828
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"77⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE78⤵PID:1124
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"79⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE80⤵PID:1108
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"81⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE82⤵PID:2036
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"83⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE84⤵
- Drops file in Windows directory
PID:1128 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"85⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE86⤵PID:1192
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"87⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE88⤵PID:1168
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"89⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE90⤵PID:2040
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"91⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE92⤵PID:1132
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"93⤵
- Drops file in Windows directory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE94⤵PID:1296
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"95⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE96⤵PID:1380
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"97⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE98⤵PID:1896
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"99⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE100⤵PID:788
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"101⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE102⤵PID:2008
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"103⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE104⤵PID:1720
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"105⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE106⤵PID:1092
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"107⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE108⤵PID:1976
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"109⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE110⤵PID:1480
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"111⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE112⤵PID:1440
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"113⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE114⤵PID:1184
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"115⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE116⤵PID:1116
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"117⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE118⤵PID:1908
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"119⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE120⤵PID:1620
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"121⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE122⤵PID:1520
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"123⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE124⤵
- Drops file in Windows directory
PID:1104 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"125⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE126⤵PID:1540
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"127⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE128⤵PID:576
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"129⤵
- Drops file in Windows directory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE130⤵PID:1524
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"131⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE132⤵PID:1596
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"133⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE134⤵PID:988
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"135⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE136⤵PID:1936
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"137⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE138⤵PID:1940
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"139⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE140⤵PID:1020
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"141⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE142⤵PID:796
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"143⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE144⤵PID:696
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"145⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE146⤵PID:776
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"147⤵PID:420
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE148⤵PID:856
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"149⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE150⤵
- Drops file in Windows directory
PID:1688 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"151⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE152⤵
- Drops file in Windows directory
PID:1192 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"153⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE154⤵PID:2024
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"155⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE156⤵PID:1888
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"157⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE158⤵PID:432
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"159⤵
- Drops file in Windows directory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE160⤵PID:680
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"161⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE162⤵PID:1068
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"163⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE164⤵PID:1592
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"165⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE166⤵PID:1624
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"167⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE168⤵PID:944
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"169⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE170⤵PID:108
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"171⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE172⤵PID:1980
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"173⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE174⤵PID:888
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"175⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE176⤵PID:1108
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"177⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE178⤵PID:1792
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"179⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE180⤵PID:1920
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"181⤵PID:420
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE182⤵PID:1128
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"183⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE184⤵PID:1272
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"185⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE186⤵PID:840
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"187⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE188⤵PID:1564
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"189⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE190⤵PID:1900
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"191⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE192⤵PID:576
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"193⤵
- Drops file in Windows directory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE194⤵PID:924
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"195⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE196⤵PID:760
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"197⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE198⤵PID:1992
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"199⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE200⤵PID:1460
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"201⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE202⤵PID:1956
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"203⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE204⤵PID:1476
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"205⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE206⤵PID:1876
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"207⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE208⤵PID:796
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"209⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE210⤵PID:976
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"211⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE212⤵PID:544
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"213⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE214⤵PID:1872
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"215⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE216⤵PID:1208
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"217⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE218⤵PID:1396
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"219⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE220⤵PID:1816
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"221⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE222⤵PID:1744
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"223⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE224⤵PID:1604
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"225⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE226⤵PID:1524
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"227⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE228⤵PID:1640
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"229⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE230⤵PID:740
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"231⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE232⤵PID:288
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"233⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE234⤵PID:1940
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"235⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE236⤵PID:1976
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"237⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE238⤵PID:888
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"239⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE240⤵PID:1440
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1DED4B~1.EXE"241⤵PID:1464
-