Malware Analysis Report

2024-11-16 12:11

Sample ID 240714-jh4crsthrg
Target ORDER_SL.EXE.exe
SHA256 61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e
Tags
neshta execution persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

61d0fa3933d0620b188c69ca85d91241e252ac419b46341ad1eac5dff7c9676e

Threat Level: Known bad

The file ORDER_SL.EXE.exe was found to be: Known bad.

Malicious Activity Summary

neshta execution persistence spyware stealer

Neshta

Command and Scripting Interpreter: PowerShell

Reads user/profile data of web browsers

Modifies system executable filetype association

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Scheduled Task/Job: Scheduled Task

Suspicious use of AdjustPrivilegeToken

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-14 07:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-14 07:41

Reported

2024-07-14 07:43

Platform

win7-20240705-en

Max time kernel

142s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe"

Signatures

Neshta

persistence spyware neshta

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\directx.sys C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
File opened for modification C:\Windows\directx.sys C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
File opened for modification C:\Windows\directx.sys C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
N/A N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2528 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 2528 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 2528 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 2528 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 1276 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 1276 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 1276 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 1276 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 572 wrote to memory of 1704 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe
PID 572 wrote to memory of 1704 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe
PID 572 wrote to memory of 1704 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe
PID 572 wrote to memory of 1704 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe
PID 1276 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 1276 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 1276 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 1276 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 2148 wrote to memory of 1408 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe
PID 2148 wrote to memory of 1408 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe
PID 2148 wrote to memory of 1408 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe
PID 2148 wrote to memory of 1408 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe
PID 1276 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 1276 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 1276 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 1276 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 1620 wrote to memory of 1624 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\schtasks.exe
PID 1620 wrote to memory of 1624 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\schtasks.exe
PID 1620 wrote to memory of 1624 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\schtasks.exe
PID 1620 wrote to memory of 1624 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\schtasks.exe
PID 1276 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 1276 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 1276 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 1276 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 1276 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 1276 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 1276 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 1276 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 1276 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 1276 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 1276 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 1276 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 1276 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 1276 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 1276 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 1276 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 1680 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 1680 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 1680 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 1680 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 2500 wrote to memory of 1656 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE
PID 2500 wrote to memory of 1656 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE
PID 2500 wrote to memory of 1656 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE
PID 2500 wrote to memory of 1656 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE
PID 1656 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE C:\Windows\svchost.com
PID 1656 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE C:\Windows\svchost.com
PID 1656 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE C:\Windows\svchost.com
PID 1656 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE C:\Windows\svchost.com
PID 1804 wrote to memory of 1520 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe
PID 1804 wrote to memory of 1520 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe
PID 1804 wrote to memory of 1520 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe
PID 1804 wrote to memory of 1520 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe
PID 1656 wrote to memory of 296 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE C:\Windows\svchost.com
PID 1656 wrote to memory of 296 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE C:\Windows\svchost.com
PID 1656 wrote to memory of 296 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE C:\Windows\svchost.com
PID 1656 wrote to memory of 296 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE C:\Windows\svchost.com

Processes

C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe

"C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe"

C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe

C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe"

C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe

C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eiVfWxqyEFoV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp722.tmp"

C:\Windows\SysWOW64\schtasks.exe

C:\Windows\System32\schtasks.exe /Create /TN Updates\eiVfWxqyEFoV /XML C:\Users\Admin\AppData\Local\Temp\tmp722.tmp

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe

C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe"

C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe

C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eiVfWxqyEFoV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4470.tmp"

C:\Windows\SysWOW64\schtasks.exe

C:\Windows\System32\schtasks.exe /Create /TN Updates\eiVfWxqyEFoV /XML C:\Users\Admin\AppData\Local\Temp\tmp4470.tmp

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe

C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eiVfWxqyEFoV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8259.tmp"

C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe

C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe

C:\Windows\SysWOW64\schtasks.exe

C:\Windows\System32\schtasks.exe /Create /TN Updates\eiVfWxqyEFoV /XML C:\Users\Admin\AppData\Local\Temp\tmp8259.tmp

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe"

C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe

C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eiVfWxqyEFoV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC024.tmp"

C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe

C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe

C:\Windows\SysWOW64\schtasks.exe

C:\Windows\System32\schtasks.exe /Create /TN Updates\eiVfWxqyEFoV /XML C:\Users\Admin\AppData\Local\Temp\tmpC024.tmp

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe"

C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe

C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eiVfWxqyEFoV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFCD6.tmp"

C:\Windows\SysWOW64\schtasks.exe

C:\Windows\System32\schtasks.exe /Create /TN Updates\eiVfWxqyEFoV /XML C:\Users\Admin\AppData\Local\Temp\tmpFCD6.tmp

C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe

C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe"

C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe

C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eiVfWxqyEFoV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp39C6.tmp"

C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe

C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe

C:\Windows\SysWOW64\schtasks.exe

C:\Windows\System32\schtasks.exe /Create /TN Updates\eiVfWxqyEFoV /XML C:\Users\Admin\AppData\Local\Temp\tmp39C6.tmp

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe

C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eiVfWxqyEFoV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp76E5.tmp"

C:\Windows\SysWOW64\schtasks.exe

C:\Windows\System32\schtasks.exe /Create /TN Updates\eiVfWxqyEFoV /XML C:\Users\Admin\AppData\Local\Temp\tmp76E5.tmp

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe

C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eiVfWxqyEFoV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB3C5.tmp"

C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe

C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe

C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe

C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\SysWOW64\schtasks.exe

C:\Windows\System32\schtasks.exe /Create /TN Updates\eiVfWxqyEFoV /XML C:\Users\Admin\AppData\Local\Temp\tmpB3C5.tmp

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe"

C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe

C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eiVfWxqyEFoV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF0B5.tmp"

C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe

C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe

C:\Windows\SysWOW64\schtasks.exe

C:\Windows\System32\schtasks.exe /Create /TN Updates\eiVfWxqyEFoV /XML C:\Users\Admin\AppData\Local\Temp\tmpF0B5.tmp

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe

MD5 fd151dbc522da341d7c5540e6a90d624
SHA1 4fe3c3f08021ce65120246b0428ad5fafe001d6e
SHA256 bc984064d01424dfd6a7c530a1927fe5e3fd3c659988ccd503c3fbfd99462a3f
SHA512 3c3356f1f59235cdcb720939aad4b87939778695d9b9cf2ed1d0d31844a50844bf984a9d1b3f7c15af25286e55f0102f1826b19315eb79a65423942e8431eaed

C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE

MD5 754309b7b83050a50768236ee966224f
SHA1 10ed7efc2e594417ddeb00a42deb8fd9f804ed53
SHA256 acd32dd903e5464b0ecd153fb3f71da520d2e59a63d4c355d9c1874c919d04e6
SHA512 e5aaddf62c08c8fcc1ae3f29df220c5c730a2efa96dd18685ee19f5a9d66c4735bb4416c4828033661990604669ed345415ef2dc096ec75e1ab378dd804b1614

memory/1276-13-0x0000000073D0E000-0x0000000073D0F000-memory.dmp

memory/1276-14-0x00000000000E0000-0x00000000001A8000-memory.dmp

memory/1276-15-0x0000000073D00000-0x00000000743EE000-memory.dmp

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

memory/1276-39-0x00000000003A0000-0x00000000003B2000-memory.dmp

memory/1276-89-0x00000000003D0000-0x00000000003D8000-memory.dmp

memory/1276-90-0x00000000003E0000-0x00000000003EE000-memory.dmp

memory/1276-91-0x0000000004DB0000-0x0000000004E3E000-memory.dmp

memory/2528-93-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Windows\svchost.com

MD5 2f50aca08ffc461c86e8fb5bbedda142
SHA1 6fc5319d084c6e13f950c24c78a9cadb7793c638
SHA256 d60208f3894f4556caae5ed2297c0ef1593a4a66f5af8f3f2e44a8f2896bbf8e
SHA512 785225fe823c5724c7ebbfb17f31ffcfc2b3b852369b4d3e002b54476ad8c0f4a5d6ac29d43886361bc8deda29db9f9ce70b1e4496b08390a8ead50ddac9d46e

memory/572-105-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp

MD5 60b06d99e5dea3a84e35dc99617aadfd
SHA1 82a1d5b43a243e35b3a8f9c0c84ecde5c37130ed
SHA256 aed48d18874eceb52a820b7accf26499b67da81b167ee2beb07ee4df8800057c
SHA512 83862a73a0d747ce0be7f3d6599dc2600ce158dc39b3bc64508023b0ce5b798cf1f0d4f439b4d9105d4a90e0a37a9db87a69bc4c2f92aedf57dcbf12a6853df2

memory/2148-117-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Windows\directx.sys

MD5 20dd9868b9ae8ac65bab31b5650890b0
SHA1 6aa5309826f48d575489ed546bfd17c80a3aa02d
SHA256 7fbb99a259c044e8bbf6b4662eb79703b3fce7f12bc7f0f069469a7778bcc347
SHA512 ed2b0ef383851a5cff3796c63b189745d35b4763016fe8aa229bacfdd89e15525056503a4db339aa3437d88b8d8608ba1755ca563686eb56deacb16375df7480

C:\Windows\directx.sys

MD5 eeeb45e7168435a05021519dece54ce3
SHA1 df05ed8dc583d17b54cf270dbbbbe36937769941
SHA256 b6063fa83cf0d842cf1a0fa2f30dd20d638b4b380cf351534b82cef9e14be9ac
SHA512 538218614b1f8b3f6b6244857b8271687b7e9036f1ab1bd489fff92782674522c43bc312989d4ac3e58f5d335cdda8c0d898a4bb9630d1c5a467e38f332fb501

memory/1620-126-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Windows\directx.sys

MD5 bb9266310600ae29b5e2fdafb691a0d9
SHA1 233de87ff12f3faefa02f1ea72372a5eda430cf7
SHA256 89e66668a6461038d268ff55eaf2dc60a536409260f6bff2cc8624b08faec798
SHA512 803f45d86dabeee8855351e11f25df6ce577d202384b77d93902b37e86b71f8634e1a163be4d8ee6da96f69573809b09169c175493139daa7b5c1d1178f9ae27

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5JCKIKJMWXEVTWAWV05Y.temp

MD5 b1372c05d7031dd6704f8e4dbce0ebe9
SHA1 9de7634d5c4ba2752f1418efcd023609b2782e9c
SHA256 7ba903ffbaee64cc192f06bc0d09f257aaad1cc6994f76b871e18acb92c9c141
SHA512 bb696309cdb78e93a8511d83d48f47213d1260a7a1c080350dbacebdc1f586e5ca129c09ae68b4de022dda3ccd232357a2f4d001736de47ae00358ab90aecd44

memory/2500-168-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1656-169-0x00000000006A0000-0x00000000006B2000-memory.dmp

memory/1680-148-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1680-146-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1680-145-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1680-143-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1680-141-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1680-139-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1680-137-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1680-135-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1680-133-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1680-131-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1276-170-0x0000000073D00000-0x00000000743EE000-memory.dmp

C:\Windows\directx.sys

MD5 97454187496693e356fa500805b62877
SHA1 ce6cf47023707c5438240a64e27d41f63385d056
SHA256 c77ba3f15d7cca2cd93e258d52461d32526bca4448feca694fd001dd3afd81db
SHA512 a5933d13e9bacb8f389fcfbaddf18ba1f7b3a794b2413b0217b72e32c6ba97290e0ad0a0f9f43d223089e75fd1e4fb18fca2e75f4d11e5ce40ed5b7a00d1ff04

memory/1804-180-0x0000000000400000-0x000000000041B000-memory.dmp

memory/296-191-0x0000000000400000-0x000000000041B000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 3cf898844d03c514f64f458dd694844e
SHA1 20f0fec8434c3ebc438a03017ea9a1036418277b
SHA256 0b4ebd1c47c74115c5c27cc70b5a0a3f29a72b4b3011cd00f1762ec51bbdaf60
SHA512 8f905c823b0c90a7932652d4645a15d2427a56d25b43d46d9c9811adfb0e9a9adb1112e7ef002d805d717cd2950b49d0b646f3341433068b172a6fd4cc8cc837

memory/2392-200-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3000-244-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2884-254-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1940-319-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1712-265-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2152-274-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2460-373-0x0000000000170000-0x0000000000238000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpFCD6.tmp

MD5 cf812357909cef7575c8c110447ad73f
SHA1 33fe30ab24154b55ee93d1db6a356229dde64217
SHA256 30ab59bcb9f1240aea947dbf1a7887945eb136f830116f73a06a3655b2c560a1
SHA512 bc1c9bc91ccfa5cf640b4f591a351c6b8c679461684a544aa6f0672852db6008e9ff4fbae536b855f6f45cb8770982f1b8efd110a67341e21dea82f8cc481f63

memory/1884-426-0x0000000000230000-0x00000000002F8000-memory.dmp

memory/2008-492-0x0000000000620000-0x0000000000632000-memory.dmp

C:\Windows\directx.sys

MD5 a792ac30dfa953597d293c797f655d2c
SHA1 00674b6bbfdd1f1d04e661e36fb3c7815dd3419e
SHA256 0e8f87e7b8292e272e6115103c2cf305b9c2d1cae0d462b55adf2be890a19954
SHA512 d8db2cf93b3655823629ed8d1029845529fb2ec86f552bdc5f55f9fc0ede9b7dc69d39fc2580751ad2da7f9f45814c5df700c6aa6216cf61a020f98f83d32969

memory/1276-661-0x0000000000710000-0x0000000000722000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-14 07:41

Reported

2024-07-14 07:43

Platform

win10v2004-20240709-en

Max time kernel

149s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe"

Signatures

Neshta

persistence spyware neshta

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~3.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MI9C33~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1572 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 1572 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 1572 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 4544 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 4544 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 4544 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 1580 wrote to memory of 2288 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1580 wrote to memory of 2288 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1580 wrote to memory of 2288 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4544 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 4544 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 4544 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 4544 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 4544 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 4544 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 2224 wrote to memory of 3672 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2224 wrote to memory of 3672 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2224 wrote to memory of 3672 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4792 wrote to memory of 64 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\schtasks.exe
PID 4792 wrote to memory of 64 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\schtasks.exe
PID 4792 wrote to memory of 64 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\schtasks.exe
PID 4544 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 4544 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 4544 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 4544 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 4544 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 4544 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 4544 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 4544 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 4544 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 4544 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 4544 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe
PID 916 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 916 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 916 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe C:\Windows\svchost.com
PID 3572 wrote to memory of 1356 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE
PID 3572 wrote to memory of 1356 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE
PID 3572 wrote to memory of 1356 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE
PID 1356 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE C:\Windows\svchost.com
PID 1356 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE C:\Windows\svchost.com
PID 1356 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE C:\Windows\svchost.com
PID 4988 wrote to memory of 400 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4988 wrote to memory of 400 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4988 wrote to memory of 400 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1356 wrote to memory of 3744 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE C:\Windows\svchost.com
PID 1356 wrote to memory of 3744 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE C:\Windows\svchost.com
PID 1356 wrote to memory of 3744 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE C:\Windows\svchost.com
PID 3744 wrote to memory of 5116 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3744 wrote to memory of 5116 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3744 wrote to memory of 5116 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1356 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE C:\Windows\svchost.com
PID 1356 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE C:\Windows\svchost.com
PID 1356 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE C:\Windows\svchost.com
PID 2592 wrote to memory of 932 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\schtasks.exe
PID 2592 wrote to memory of 932 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\schtasks.exe
PID 2592 wrote to memory of 932 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\schtasks.exe
PID 1356 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE
PID 1356 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE
PID 1356 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE
PID 1356 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE
PID 1356 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE
PID 1356 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE
PID 1356 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE
PID 1356 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe

"C:\Users\Admin\AppData\Local\Temp\ORDER_SL.EXE.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eiVfWxqyEFoV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1613.tmp"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe

C:\Windows\SysWOW64\schtasks.exe

C:\Windows\System32\schtasks.exe /Create /TN Updates\eiVfWxqyEFoV /XML C:\Users\Admin\AppData\Local\Temp\tmp1613.tmp

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eiVfWxqyEFoV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5F22.tmp"

C:\Windows\SysWOW64\schtasks.exe

C:\Windows\System32\schtasks.exe /Create /TN Updates\eiVfWxqyEFoV /XML C:\Users\Admin\AppData\Local\Temp\tmp5F22.tmp

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eiVfWxqyEFoV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA004.tmp"

C:\Windows\SysWOW64\schtasks.exe

C:\Windows\System32\schtasks.exe /Create /TN Updates\eiVfWxqyEFoV /XML C:\Users\Admin\AppData\Local\Temp\tmpA004.tmp

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eiVfWxqyEFoV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE0F5.tmp"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe

C:\Windows\SysWOW64\schtasks.exe

C:\Windows\System32\schtasks.exe /Create /TN Updates\eiVfWxqyEFoV /XML C:\Users\Admin\AppData\Local\Temp\tmpE0F5.tmp

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eiVfWxqyEFoV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp209E.tmp"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe

C:\Windows\SysWOW64\schtasks.exe

C:\Windows\System32\schtasks.exe /Create /TN Updates\eiVfWxqyEFoV /XML C:\Users\Admin\AppData\Local\Temp\tmp209E.tmp

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eiVfWxqyEFoV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6131.tmp"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe

C:\Windows\SysWOW64\schtasks.exe

C:\Windows\System32\schtasks.exe /Create /TN Updates\eiVfWxqyEFoV /XML C:\Users\Admin\AppData\Local\Temp\tmp6131.tmp

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eiVfWxqyEFoV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA29F.tmp"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe

C:\Windows\SysWOW64\schtasks.exe

C:\Windows\System32\schtasks.exe /Create /TN Updates\eiVfWxqyEFoV /XML C:\Users\Admin\AppData\Local\Temp\tmpA29F.tmp

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eiVfWxqyEFoV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE229.tmp"

C:\Windows\SysWOW64\schtasks.exe

C:\Windows\System32\schtasks.exe /Create /TN Updates\eiVfWxqyEFoV /XML C:\Users\Admin\AppData\Local\Temp\tmpE229.tmp

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\eiVfWxqyEFoV.exe

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

"C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_~1.EXE

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 34.58.20.217.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\3582-490\ORDER_SL.EXE.exe

MD5 fd151dbc522da341d7c5540e6a90d624
SHA1 4fe3c3f08021ce65120246b0428ad5fafe001d6e
SHA256 bc984064d01424dfd6a7c530a1927fe5e3fd3c659988ccd503c3fbfd99462a3f
SHA512 3c3356f1f59235cdcb720939aad4b87939778695d9b9cf2ed1d0d31844a50844bf984a9d1b3f7c15af25286e55f0102f1826b19315eb79a65423942e8431eaed

memory/4544-13-0x0000000073EEE000-0x0000000073EEF000-memory.dmp

memory/4544-14-0x0000000000EB0000-0x0000000000F78000-memory.dmp

memory/4544-15-0x0000000005EA0000-0x0000000006444000-memory.dmp

memory/4544-16-0x0000000005990000-0x0000000005A22000-memory.dmp

memory/4544-17-0x0000000005980000-0x000000000598A000-memory.dmp

memory/4544-18-0x0000000073EE0000-0x0000000074690000-memory.dmp

memory/4544-19-0x0000000005D10000-0x0000000005D22000-memory.dmp

C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

MD5 d9e8a1fa55faebd36ed2342fedefbedd
SHA1 c25cc7f0035488de9c5df0121a09b5100e1c28e9
SHA256 bd7696911d75a9a35dfd125b24cb95003f1e9598592df47fa23a2568986a4a9a
SHA512 134644c68bd04536e9ea0a5da6e334d36b1ce8012a061fa6dabd31f85c16a1ac9eee8c40fee3d55f25c4d4edf0672de8ce204e344c800361cbcff092c09d7a33

memory/1572-103-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4544-104-0x0000000006B60000-0x0000000006B68000-memory.dmp

memory/4544-105-0x0000000006B70000-0x0000000006B7E000-memory.dmp

memory/4544-106-0x0000000006BD0000-0x0000000006C5E000-memory.dmp

memory/4544-107-0x00000000098E0000-0x000000000997C000-memory.dmp

C:\Windows\svchost.com

MD5 2f50aca08ffc461c86e8fb5bbedda142
SHA1 6fc5319d084c6e13f950c24c78a9cadb7793c638
SHA256 d60208f3894f4556caae5ed2297c0ef1593a4a66f5af8f3f2e44a8f2896bbf8e
SHA512 785225fe823c5724c7ebbfb17f31ffcfc2b3b852369b4d3e002b54476ad8c0f4a5d6ac29d43886361bc8deda29db9f9ce70b1e4496b08390a8ead50ddac9d46e

C:\Windows\directx.sys

MD5 a1d09e441d80de4eabb002bc9e4d9304
SHA1 11e6908fad019f30f01b44df7c33ddc141e03a15
SHA256 9c9f5c8354e71f6ad31f854b58d01f1772138f8fe37481777073729d94586edd
SHA512 68ecdb886daab427ec20baf9e310d89223c55cd959999826072c05ced6498bbaa6d0ba44730f863d0387904a33b9d6ab4125338fcad4109347aa0ffad25b3b8d

C:\Windows\directx.sys

MD5 eeeb45e7168435a05021519dece54ce3
SHA1 df05ed8dc583d17b54cf270dbbbbe36937769941
SHA256 b6063fa83cf0d842cf1a0fa2f30dd20d638b4b380cf351534b82cef9e14be9ac
SHA512 538218614b1f8b3f6b6244857b8271687b7e9036f1ab1bd489fff92782674522c43bc312989d4ac3e58f5d335cdda8c0d898a4bb9630d1c5a467e38f332fb501

memory/4792-138-0x0000000000400000-0x000000000041B000-memory.dmp

memory/916-142-0x0000000000400000-0x000000000041B000-memory.dmp

memory/916-140-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2224-131-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4544-144-0x0000000073EE0000-0x0000000074690000-memory.dmp

C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE

MD5 823cb3e3a3de255bdb0d1f362f6f48ab
SHA1 9027969c2f7b427527b23cb7ab1a0abc1898b262
SHA256 b8c5b99365f5ac318973b151fe3fe2a4ad12546371df69e1b7d749f7a4ce356f
SHA512 0652b60e07aa5a469b9cf1013a1ed98d0352996c59b9a66f612be2bc0081d8ec8a65a44a3977d2e188cd8ee3311edb251b818cf300d152ed5f633679a6cf834c

C:\Windows\directx.sys

MD5 bb9266310600ae29b5e2fdafb691a0d9
SHA1 233de87ff12f3faefa02f1ea72372a5eda430cf7
SHA256 89e66668a6461038d268ff55eaf2dc60a536409260f6bff2cc8624b08faec798
SHA512 803f45d86dabeee8855351e11f25df6ce577d202384b77d93902b37e86b71f8634e1a163be4d8ee6da96f69573809b09169c175493139daa7b5c1d1178f9ae27

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 de09a96b18bdae09efcbecefe46e8cba
SHA1 f954fef137692241b50276180740ab053ddbfe1a
SHA256 4cd94b2cd0b75ab97d29e7cf162cda7b84b0b73b7288674222a4f0e3b17aa2d2
SHA512 4599c9298422e4550f54b072412dd4fb0248cd86c6fcd4b003d4b17344d462973bab45e34aeda57d1835bec152e60a5e7f7c5fcf2487f8b1aa6118c1c56d4a0e

memory/2288-171-0x0000000004FD0000-0x0000000005006000-memory.dmp

memory/2288-173-0x00000000056C0000-0x0000000005CE8000-memory.dmp

C:\PROGRA~2\Google\Update\DISABL~1.EXE

MD5 2424d589d7997df1356c160a9a82088c
SHA1 ca9b479043636434f32c74c2299210ef9f933b98
SHA256 9d6982a566148cf69cb6aec417baddca680e647931315736a6c19f2ba91c4d60
SHA512 4dd0a69c1dfb0e88fc6b24c97e14dd0ad1ac0226dd372d09123b6a2ec3c107fc94a810764d16e111d1cf7e81a23b70b84d36cbfbf1e32986d00de3cd9e315c2b

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE

MD5 24eeb998cb16869438b95642d49ac3dd
SHA1 b45aa87f45250aa3482c29b24fa4aa3d57ae4c71
SHA256 a2cfd55902b1750070e9154a90e29a10b9e6fa0c03bc82d8f198678e9bc46cd0
SHA512 2ac6de5c3e52b31355300ff4e846ed0627d8d4af02c4c07c0886694a09237ef2ee76e004883fae76a959bef0b60bd4138a9c88ad22139c6b859786c8e37bb358

C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE

MD5 ba7183fd7df27ec1e611f848d25ffdee
SHA1 0cc8f3e9c24da5f02ff57a66b9e7485763604beb
SHA256 7de95943142a2ccc03a6e84846b045c374bdb71a444b6116901d43f9f9e635ac
SHA512 2c6316e94a6d3dc668892aa7919ed2b8b852b5844c9e223329e3c91a4d0e6c3f5eb03dc327e3a92265e0fed89406cb2210b9b919331e3a8eda1ef4a55f74d3a5

C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE

MD5 788fde156cc6e54ee2962198ac4a6c53
SHA1 09e1560bf5ec8fb5706a91eff97e327af7b962ae
SHA256 4c4344610c8ba2c3b2c0f2e47c45b1d8c9799ef3448d409607d1f139ee523ebc
SHA512 8ed288766dd4cc65328136d200bb1ed3a38c33b82720979be78ab02466b8dbaf800cceb0c5967268286b1adf3ec6446ceec42b1f12ab6f0ccb77fef29b0c2e8c

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 273885649619e31a6d1daaa437ad296f
SHA1 0900930a4d50b2ffcc77275d312a91ebaeb64c5e
SHA256 c089cbb4cca70b5c8efe224924c242e48247937871b21896525a41dfb897d40e
SHA512 82ea451c97c19f67cf2637a81c2151145064416a02a799eb3b8ddaab348af9a50102f05ac9229fb1db8c750ecbc03a380656cf3179e7848adeb0c8b2a784d840

C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~3.EXE

MD5 2925993d37c49204c9637e5c1bb5c949
SHA1 17dacda06c542a6fa6391b2b57aba8675cf7c924
SHA256 3c6212746a75da30bf30c420ce17f4a9d45e1cbd15df50b9acfcb4b655514a3e
SHA512 65616ffb2526adebcd447e9c7e838bb2a1dc5829c6097412fcdb2d245c33ea895922736d00bb45de4769307783c0670750ba3efcccd85c98f56a954334264965

memory/2288-219-0x0000000005D20000-0x0000000005D42000-memory.dmp

memory/3572-226-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2288-227-0x0000000006030000-0x0000000006384000-memory.dmp

memory/2288-225-0x0000000005FC0000-0x0000000006026000-memory.dmp

memory/2288-224-0x0000000005EE0000-0x0000000005F46000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ukylyb4t.3c0.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE

MD5 cd4af683704c71887125716ca891e18c
SHA1 64d02bac29cfeeed31978438d572230f316d61df
SHA256 1e6a087180f0e5a8e738718de2d4d99c1a4b6d89bd2a84ad19ab45f7dd9225c5
SHA512 dda5661f1e95e1a6dc0ce62a5b476aa335ddde431d47fb6cabffe36947376f6c583f83560dc43da4bc4432052a95ed61f0553ade59308582510c25a5f828921a

C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE

MD5 74a044a62415d995102a0d58424bc49e
SHA1 10aeaa3fa60f5550bab9321048675c433a27e12a
SHA256 bf70a32a354a2c7ec912701f3350b8706bd9f422ea091de93088abe8e2b58efa
SHA512 0aa5780b75b506dadcdd3902b4defb847c1f7e6deca78596c70e95cf2e179489f8748e0580aacd07875aa75fba08af13e7c6463925424ead18720a2934ac210b

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE

MD5 ecda5b4161dbf34af2cd3bd4b4ca92a6
SHA1 a76347d21e3bfc8d9a528097318e4b037d7b1351
SHA256 98e7a35dd61a5eeea32ca5ff0f195b7e5931429e2e4b12d1e75ca09ddab3278f
SHA512 3cd3d64e7670ab824d36a792faa5d16a61f080d52345e07b0ef8396b2a1481876a3b30fc702bf0018a1b02c7788c3c7f1b016590c5b31485a90e3a375f11dade

memory/1356-237-0x0000000005A80000-0x0000000005A92000-memory.dmp

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE

MD5 a31628879099ba1efd1b63e81771f6c7
SHA1 42d9de49d0465c907be8ee1ef1ccf3926b8825fe
SHA256 031b0b0de72eba9350a1234eba7489bc04f94823501fc6a200266fa94b8c51dc
SHA512 0e86020f61fd08578507c3cd37385ffa2ffd964407a689b4c3d532fe4dc826eea58391f938840d18ecfa6bae79c6ece31b8f63b50366c2fa4d6ecf5194475759

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe

MD5 6b7a2ce420e8dd7484ca4fa4460894ae
SHA1 df07e4a085fc29168ae9ec4781b88002077f7594
SHA256 dec51011b3bd2d82c42d13f043fac935b52adeaa17427ce4e21e34fcbd2231e4
SHA512 7d2cd278ee45ec0e14145f2be26b8cdbe3312b300aa216532c41e839ba61c12ae379025568c85634f0ec3bc95cc481bb17f99ab30c711986651569f0f1f81beb

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE

MD5 b8bffe8467716db4da9d94061dc33d07
SHA1 db4bac1757b1b60b26e2fef0fc88ce708efad352
SHA256 b03986224aa28f1e1850bd2fcd1a5f5f2fea34c2c0815d8e6943f0a98b754af2
SHA512 5d6f6363c9c87c61d2be785280d420725fe7cc4b68908e78fc82dc480260a400500a84f1c9247b34437cd520d702ef5fc4546024fed891231630514d1418592c

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE

MD5 af9aba6ab24cba804abba88d1626b2b9
SHA1 6a387c9ec2c06178476f8439a5a3d9149c480a9a
SHA256 e6a06e738140a8cc089bc607e5f5e1e2b224b71d52e0be0d01f9deb8e9763a90
SHA512 9e004f2eccb4e48d2c98a8168f7fe752ad3195b66f0aa1d7ec07dd5819539bc94a50ffb1deb291e7fea11932eb88fb5938b1ef0a93cd8b1902495d1f7bd2d950

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE

MD5 032ee4d65b62d87cf809438556d30429
SHA1 34458fcefe3c67f19c3d2c94389fc99e54e74801
SHA256 0099c710e406e0423bb0b11eb4c113508c67f84a0972a2d14c038687cac1753b
SHA512 6b912d51e93f1e4756ecc5321ec08a6eb5e15413a9d9cf568bd14ce2a5199d064f6dd5c7d9d5155296d1a4ab5852c81a8fc138565fb788e7402c09b61281a5cd

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe

MD5 69e1e0de795a8bf8c4884cb98203b1f4
SHA1 a17f2ba68776596e2d1593781289c7007a805675
SHA256 2b6d153b9df86033b7a83eb4f521fd4f7aeec35dc54ef8d1ffe80f5bbd030dbb
SHA512 353b664271d0f49f94b60c7fbaf5ab6d5b8df7690383517a90ba675f750d9b28628bbd5ed92a6782879607f4c21214b15ea95fd6a5a8d6f9540a1b75ddb9e665

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE

MD5 ae390fa093b459a84c27b6c266888a7e
SHA1 ad88709a7f286fc7d65559e9aee3812be6baf4b2
SHA256 738b7b5da8ca4798043672d2a32913e0f64268c7861eecc9fcc4c7f9d440d8cd
SHA512 096b5190efefe4c5272637e0721dcd339883f551c5e0cce568ed0bd63b31fb9acef6b09d310966482dbc7a944cc7a5878b0ad6bd68c30d1871254865a1660851

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE

MD5 b84ae39dd0420080bd9e6b9557eea65b
SHA1 5326a058a3bcc4eb0530028e17d391e356210603
SHA256 92439a773781fc1b4e45de7fad393bb9ccd05af99dc1a1bb2246a4befb1f5924
SHA512 860ae09c5806622420147af1073cecc065786968737547276641af710b4caccd16b787bdf7212dd1d8ab16e257dd5c5cd20790bf000d75d82410cbd5bf7af388

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE

MD5 fdad5d6d8cf37e8c446dcd6c56c718c3
SHA1 412883fd3bb56f2b850d2c29ee666d9b75636faf
SHA256 2ed31146dc94132acafc7e759086f18c83560693a813b1d842a30908f50faf7c
SHA512 9866ddd370e7ab75aea143c5ede3ee96700ed662aab7fb3e989f9beedb2800b488f985a8069a61025cc8201bbc42e23d744717988587c2a8a66f2e91ea7cbbbc

C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE

MD5 001760b2a66fb4fff1e2c42bc39e5421
SHA1 1980cafc246e5a31b6e78bcd5eec1726c9789046
SHA256 1ae63f874694d576e6b6c2f409a71e49cf607e62b2a7a646322294009c7b813a
SHA512 a37e499451abc2b9399eafe8d866210bdaac2c73a4f1dbe16c272fa56a8b5bcb1efe41e198effb9c84a77de269cbb5b81871d88eb726f95c3d3b4067bfc0c7df

C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE

MD5 78f77aff4993684fdbcad13c74d5f364
SHA1 0b02ed9112021b3c65778fdce0642e81dfb5b628
SHA256 9f707deff2f5b5a8c611c5926362c4ffc82f5744a4699f3fb1ee3ef6bb9b2cfb
SHA512 568c1abf5f6d13fe37cb55a5f5992dea38e30fc80812a977c0ae25ed30f67321db8f4c0da2ae4ae558e58dc430885fa13c1f7f1d6b2d6bb51ed031f042defafb

C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE

MD5 a12297c17e3747647d5c29d67edd4d9a
SHA1 6a6ed9d50d8385b2fb1da6c700934bf213e1ec2d
SHA256 288f7e376d1ba967276a05a1b00fddff236315ee0df24e543cf8b604768ae7f2
SHA512 e1004b5307f26af7c22ec051539ed633105ac6673301d31a57cb530ab76551b51aa59741397d1b9fe860bed8c93c2a21d8e828edd1612750bcec1bd068898239

C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE

MD5 6ecccb4bab82a4971897aa0bcb2f14be
SHA1 1c680d6f8ca6a0436b5935906a2d9c4699a7a412
SHA256 c661a1408b32f837e02965675400807e111dc5d43a00588011e4365dd3c24be1
SHA512 d68cae4b3c7664751bca1f73cb6b6aa0f0745bb10a76e250b9ffae82bbf2a398f17277ebe5cfd22338af9b4d4c0e0c8241eeb640bdcc0a73774612a6785ac081

C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE

MD5 b6283a7eb554d995d9a7c72dcfca14b5
SHA1 67d64907800c611bbcefd31d2494da12962f5022
SHA256 099da4830adbab785d86ca4680c041458acfe798ed8b301b2bb6bd47891ed881
SHA512 a6d96a13b8672d0f1d50ac22ba95b715527050ce91bb67dc261732e0a114ef2902e3380577546ff34860f65723a143153cea47ae31e12bb27dd3f4f5ee2245f3

C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE

MD5 48628eeb152032e8dc9af97aaaeba7cf
SHA1 e826f32c423627ef625a6618e7250f7dbc4d2501
SHA256 f271af83d96b1d536e1a1788ec0baa0c3c583ddfe61faceccaeec1470c5676ca
SHA512 18a2a247177d04d5b1b56d126d72e29b02c8378e8aa4c89bdbaefe14bcd577d7aa054b05a5db37d142a37cf869f3bc03fe9a5bba4886a52d6c2ede5052dfcc7d

C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe

MD5 7aac73055860fcd079d9407cab08276d
SHA1 482b9f337d60270c95950353f9ca8929d8926b1d
SHA256 97508a81b805937e1ca57711a51d2e8d715a2748e2f9d27d39dfecc28f3fb9e5
SHA512 f183a10eb13c083c7cd8e785a7978eee4998c33d1eb104a0ab0e54146e10651f68612249e668baa08919a5840f6f929b5452c93f71a232b30aab9e2857109fb5

C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe

MD5 de9e6086062f01926b48c2d80508d12b
SHA1 13610cca5e38925e22b6a79067df0dd9eca49fe3
SHA256 d2f956514bc885fed054dec3ad4c0e89e59a6a38390fa8432abd15eb201468b4
SHA512 60478e55b6a3d49686ed8e95e939a2384fb1440950d710e7beedb9eda24be0e6996c931d0703d6cc0065fbe5a85eff463b9e9eaadf14746593abe723636137c3

C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe

MD5 62976c65ded41b4f31c7f379c548e05c
SHA1 3827c414ad15cd67ea8635400002c4c79704250e
SHA256 80de06ea5d221e21f765a96750f821aaaf8eee23bfd9d8cde265a8da11041c66
SHA512 ddf74814c7a54a258b7200310bd644547f3a831e373c8392dddedd08b3c1ca60e864fbe2007e68fabdcfe1e923d9207039bde42a09e0ec07d69694263057fcd7

memory/3672-238-0x0000000006A70000-0x0000000006A8E000-memory.dmp

memory/3672-239-0x0000000006B70000-0x0000000006BBC000-memory.dmp

C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE

MD5 6b27dd3f7c6898e7d1bcff73d6e29858
SHA1 55102c244643d43aeaf625145c6475e78dfbe9de
SHA256 53e47df12f0ce2005f4a2a773d194c9431b325b64c205dfa4cfba45c973b65f3
SHA512 52b7a596b07935f15f008c2de38c5dfd85df18b49e5083e363b90fb321d4f1bf588627dcbe94fa6434c460243b254c5ca1dbcf2c956e49baa92e13e104500f2f

C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe

MD5 ead399a43035cf6544c96d014436fc9a
SHA1 c8ef64abb6c56cbd02e851a98214620459c8b947
SHA256 38b06ee250af6554e6740a1bb7acfb77b99ccdb8081880e01c386afa98668766
SHA512 6fa46a36c17c9496c18843e04d78d5146cdea173a74acacd9b7c63d220c49fa3a1acb65f91fe7214a1ae82ebf63fb5366beecd7f9e0aeee0cbab5d1bd0aa6d14

C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE

MD5 961c73fd70b543a6a3c816649e5f8fce
SHA1 8dbdc7daeb83110638d192f65f6d014169e0a79b
SHA256 f94ddaf929fb16d952b79c02e78439a10dd2faa78f7f66b7d52de2675e513103
SHA512 e5d97ee63b02abc65add41f6721514515b34fd79f7db23ae04cf608c2f7e0504e00b07694047b982d14d60cccf6f833b50268c693e3baf1b697d3370c0bba0b6

C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe

MD5 e115eb174536d5fbcf5164232c89c25d
SHA1 5879354de61734962d39d13316d1fe028389cc16
SHA256 57329b38314923c17e9dd9e153e894708389dd597fcb1438d5291c7627238653
SHA512 69696a2e842e0557a57ec4d12c31d5afde0cdfb80d6028ad8d9b0b59d558ad6eaf043c9da0d31c43b16b4f12894dcea69db9366772c49c758773e6c35a9fb0c5

C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE

MD5 dc6f9d4b474492fd2c6bb0d6219b9877
SHA1 85f5550b7e51ecbf361aaba35b26d62ed4a3f907
SHA256 686bec325444e43232fb20e96365bb1f1eb7c47a4e4ce246fc900d3a9784d436
SHA512 1e9c2dfeada91e69ee91cd398145e4044bd5788a628b89441c8c6ff4067ba0a399124197fd31dad26ccb76a4d866ad99918ba8e1549983be967d31b933ad9780

C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE

MD5 3e8712e3f8ce04d61b1c23d9494e1154
SHA1 7e28cd92992cdee55a02b5ece4b7c2fc4dd0c5e4
SHA256 7a8ee09f8a75b3e812f99a0b611c6720626c62c6985306a408694389a996c8e9
SHA512 d07d924f338bd36ca51c8e11931f7ff069e65942725a8e1f1ff6b81076a987ab7d787452a5fb08314edf1489e081f4164db1ad299a6d78401e630796f4487dc8

C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE

MD5 3ccfc6967bcfea597926999974eb0cf9
SHA1 6736e7886e848d41de098cd00b8279c9bc94d501
SHA256 a89d3e2109a8e35e263da363d3551258ea320a99bfb84a4b13ad563008eda8d9
SHA512 f550af4e053d89eff45c0fb00bb32e8d212645a155727d3536a3f12bb0b5550bed25516516334245b912fa4fc2e4e7c267e80da4f06d22ea128f20eb56ab4351

C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE

MD5 2e989da204d9c4c3e375a32edf4d16e7
SHA1 e8a0bf8b4ae4f26e2af5c1748de6055ba4308129
SHA256 cae320401aa01a3cef836c191c2edbd7a96bfcce9efad1a21880626a64cc4dec
SHA512 3ebf71578bef909d9411c131d0ccd38ead68cba01a8e0f845d08faa012ca2136476fe09a2859ed846641f80b7a2d9b78d49c709065a52c6b9ee149edf84c8c4f

C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE

MD5 c4a918069757a263adb9fbc9f5c9e00d
SHA1 66d749fc566763b6170080a40f54f4cda4644af4
SHA256 129a2bfe25ceabb871b65b645ef98f6799d7d273fc5ddfd33c1cb78f5b76fa3b
SHA512 4ecf32fa2c8f53ff7a08555ec5d37739dc1358352621d038669f608edf18b0dcc6dca168a2b602359c9ee098052e546e5c02603f83aad44a114192138de7b7b9

C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe

MD5 514972e16cdda8b53012ad8a14a26e60
SHA1 aa082c2fbe0b3dd5c47952f9a285636412203559
SHA256 49091e1e41980b39d8de055fe6c6a1dc69398f17817960d64743e7efb740efc4
SHA512 98bbd6f06e3ff3e94aee3620f20f89e254dde157bc8129a64cf78fefe5cf9b13c7902128c2acbd54b3def527e09a039bd1f66ba64efb85f3f0404d894cabbee4

C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE

MD5 4ab023aa6def7b300dec4fc7ef55dbe7
SHA1 aa30491eb799fa5bdf79691f8fe5e087467463f1
SHA256 8ca27077312716f79f39309156c905719a908e8ded4bf88c2ba6fa821e574673
SHA512 000e33cc2399efa9dc56c06a42f91eb64b94f30b78cf260469f45f3b876f518d2d2b62e33d8f697660ae560d595e5bd5b7a5f847c316d5f97adeb3d8f9248ab5

C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe

MD5 66a77a65eea771304e524dd844c9846a
SHA1 f7e3b403439b5f63927e8681a64f62caafe9a360
SHA256 9a7391267ab83b45a47d9fcf1e0f76002ed6640ed6a574ba51373410b94812f6
SHA512 3643ad1036075305d76dfd753b1ed29ae611b4b9f397b2520f95b1487e85155a111adc83578db8ca5d0fd1e9fe146d018e22f572c187ef468eab8d11d48fc7f4

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE

MD5 3e4c1ecf89d19b8484e386008bb37a25
SHA1 a9a92b63645928e8a92dc395713d3c5b921026b7
SHA256 1ebe469c94c2c2a5acbc3927cef19dbe2f583ba3651a55623633891c4c05cc22
SHA512 473d03abbb61609749a176a0724e427599a4f4707d72a74ed457b2198098f59fdf64b5394798db82f4064dfe964083d70af6a50a5fa2ab2674c77a99792e4e52

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe

MD5 3da833f022988fbc093129595cc8591c
SHA1 fdde5a7fb7a60169d2967ff88c6aba8273f12e36
SHA256 1ad4c736829dbcb0fcc620fd897fe0941b9c01e14ccba5d18085b3ca0416ab66
SHA512 1299d63337c958e8072d6aaa057904cbbaa51c2eec4457269ead6b72c4eb2a10882e4a5dc7afcdcab5a6910d2105c2e5ee706850074e0425ae7f87d9ea1e5537

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

MD5 ef63e5ccbea2788d900f1c70a6159c68
SHA1 4ac2e144f9dd97a0cd061b76be89f7850887c166
SHA256 a46d1ffbe9114015050b2a778859c26248f8bab22d5d1a302b59373bc20c6b45
SHA512 913371abb54e0adc94aa08372a20f07ced9f9fdc170f9e468cd39c7387c7e30c1ae238148ccf355d5c8b88b7fd63f914bb108c6cafca9a791d02d8b36468bfac

C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe

MD5 124147ede15f97b47224628152110ce2
SHA1 4530fee9b1199777693073414b82420a7c88a042
SHA256 3e815d583236b9cecd912fcc949a301d1e51b609cbb53a2285d08feea305edcd
SHA512 f4c2825380d1bb9ca889d5c5684f13aa0cacb0d6511f6409ca0972a7191195a0175e00c995407848bf09ea03cff05c7395952bf2ffd2af2015b8939f75a8e627

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE

MD5 114445130d5e083c42830d9adbf5d748
SHA1 48a62ec52b835918cc19a2df9c624a7a0d6b85e1
SHA256 a5f47d59b8d08fc85ee411ec2e1015fedda08fd4a6cae2bf7b3bb1a7db2ccb5e
SHA512 45eb73fd4e12ed70c386c733b2bc04296fb1a16be04b4cd45260c70d0e4b6cf3a87dc223ce2319d94b79c513ba19d0816bae428c466076c1de906429aaa78748

memory/3672-241-0x0000000070870000-0x00000000708BC000-memory.dmp

memory/3672-240-0x0000000007010000-0x0000000007042000-memory.dmp

memory/3672-251-0x0000000006FF0000-0x000000000700E000-memory.dmp

memory/3672-252-0x0000000007C90000-0x0000000007D33000-memory.dmp

memory/3672-253-0x00000000083C0000-0x0000000008A3A000-memory.dmp

memory/2288-254-0x0000000070870000-0x00000000708BC000-memory.dmp

memory/3672-264-0x0000000007D80000-0x0000000007D9A000-memory.dmp

memory/3672-265-0x0000000007DF0000-0x0000000007DFA000-memory.dmp

memory/3672-266-0x0000000008000000-0x0000000008096000-memory.dmp

memory/3672-267-0x0000000007F80000-0x0000000007F91000-memory.dmp

memory/1572-268-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3672-269-0x0000000005810000-0x000000000581E000-memory.dmp

memory/3672-270-0x00000000080A0000-0x00000000080B4000-memory.dmp

memory/3672-271-0x00000000080E0000-0x00000000080FA000-memory.dmp

memory/3672-272-0x00000000080C0000-0x00000000080C8000-memory.dmp

memory/1572-276-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1580-277-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1580-279-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1572-280-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Windows\directx.sys

MD5 fb35c6b9b5907c3f3f1d36067ee0a96e
SHA1 a4c3077e7c66828a539be31826d863a14401928d
SHA256 02d52bfa9560a4e710b35ce7b501ac55e82b6e4bc2114a9e22fac88c62b8d238
SHA512 694335711cc75419f7b821c9d851440d3f58a5276a79225e679507fce027df8a49efb7e16112eb40999481b5fbda0dda80c0651219a4642613721fb49752d754

memory/4988-288-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3744-297-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2592-303-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 0ba09cb9e69a9c2a911e08fccf0b84a4
SHA1 cb294ee90566ada1744a0ab1da721ea4c0dd0464
SHA256 01abb419bbfaf889306ab5c6ed8b746a2cbde3a5e477b2ddd1d915bf1d4db84a
SHA512 b83c85720913b731755f2c10ccbf6947f99dc45901779bada28e1ad2137986274c038c5d38c9ea233498db6dc7e08b81fca5c925067e91b1e4abe9c00425e7e3

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 75040f0559e34d442d86dc32b47bcdec
SHA1 cf060523cb431c174d52d5473c7acf3a030fcd7a
SHA256 17dc5788f084e1dfb0322d734ae8951b42b632c0de7be1fe797cbf993aae76ba
SHA512 7d89c1afff95db434ef99999bf49d20e427492eb21ac5f72757a7cba076094e66cd3b6e17b09652b514fd99feaf1c2c98af829f3ef5c7be05c0a899f9a7958fc

memory/400-333-0x00000000059A0000-0x0000000005CF4000-memory.dmp

memory/4808-343-0x0000000000400000-0x000000000041B000-memory.dmp

memory/400-344-0x0000000005EC0000-0x0000000005F0C000-memory.dmp

memory/1700-345-0x0000000005C80000-0x0000000005C92000-memory.dmp

memory/5116-346-0x0000000074F10000-0x0000000074F5C000-memory.dmp

memory/400-356-0x0000000074F10000-0x0000000074F5C000-memory.dmp

memory/5116-366-0x0000000006F10000-0x0000000006FB3000-memory.dmp

memory/5116-367-0x00000000071C0000-0x00000000071D1000-memory.dmp

memory/5116-368-0x0000000007200000-0x0000000007214000-memory.dmp

memory/2096-378-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2584-387-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3920-393-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Windows\directx.sys

MD5 dd8713f9437c7cf6f9b56e1216ee3326
SHA1 c4587babe91f0b1181967a0b161b0641a462eaef
SHA256 cba18bb45c4e59ed6aecb3939026d5c9cd7faff49c15698287396f6839dafa0a
SHA512 d9d5a5f1f76d1667647aff511eb732c64a444bd22158f6a89b13dc38f7ef4f4322869cd5e75c524b4500c1e0a28646f614086d70d11a75caa06c254ebee4f439

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 c12b04eb39dcb79d84e66368db626ded
SHA1 3711a7544d1a9ac74209b7fa51c7eaa5f9cb53e4
SHA256 7f76fbfa651f99923be0bfc540c5d8d0fa77127645f99db3730e5a4c5ebc6bee
SHA512 0c0d57966149b4a86c7ba4bcb7b25e5be09579a745cd86dedd52ba319a22a74d4c40f54658d24c5a282d46ca5ce1de9910b510b00610a9d8234fd7418400856e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 78b30946c86ada2b045533725b483770
SHA1 681537bf31e80121476c4ae0ba6b9df550296637
SHA256 1ab7febe858a8fc033131f6e3e8f15dda54cee4db9f26539190c3444d1daf72b
SHA512 2c9c319ec8a956d446f934f21ca9d1877e400fee08d839f1c6a209b9549d74ebb4e2df6ed13a602ff93b07ee77f443455ea26479eead3effc1db08445c87202e

memory/2556-431-0x0000000005BF0000-0x0000000005F44000-memory.dmp

memory/324-432-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2556-433-0x00000000060E0000-0x000000000612C000-memory.dmp

memory/2372-434-0x0000000005AD0000-0x0000000005AE2000-memory.dmp

memory/2556-445-0x0000000074BB0000-0x0000000074BFC000-memory.dmp

memory/1604-435-0x0000000074BB0000-0x0000000074BFC000-memory.dmp

memory/2556-455-0x0000000007270000-0x0000000007313000-memory.dmp

memory/1604-456-0x0000000007260000-0x0000000007271000-memory.dmp

memory/2556-457-0x0000000007600000-0x0000000007614000-memory.dmp

memory/4732-468-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4524-481-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3356-482-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 21820610794cd7384228b75fef20278d
SHA1 484e447cfe945a0c7c3b4d98091a305c6794aace
SHA256 21789a0a09fae64f307766232a47c888cdac9407eb6e1eab3b110fd7be72d378
SHA512 059ca8f690cb6eb3a32671d48c7513b8cfdd244d1f1473aa6bd43497d0386510d9b15f804c214a9f2b86e546477e2d3fad5d1874f8e3307fc9b588cdbb84e272

memory/3512-497-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 7d41526ed022b4aeb4fbaf1689fd0166
SHA1 00c1d50ee6819b5ad7e782cf1d1394309d148c33
SHA256 2ab6b0e7ec7a261782c143adc61412d2584daff19fd8a76146d1ff173bfd26c9
SHA512 c07ad23575f19c0312726cb412b6b53168346c7e3549b671acdafe53477c4773f91ee6b876029b470c9152cc00652e0110b63a90d42c27f6521b040a4feb24cc

memory/1488-512-0x0000000005780000-0x0000000005AD4000-memory.dmp

memory/3440-515-0x0000000005B40000-0x0000000005B52000-memory.dmp

memory/1488-523-0x0000000005CD0000-0x0000000005D1C000-memory.dmp

memory/1488-534-0x0000000006E90000-0x0000000006F33000-memory.dmp

memory/1488-524-0x0000000074830000-0x000000007487C000-memory.dmp

memory/2352-535-0x0000000074830000-0x000000007487C000-memory.dmp

memory/1488-545-0x0000000007180000-0x0000000007191000-memory.dmp

memory/1488-546-0x00000000071C0000-0x00000000071D4000-memory.dmp

memory/3320-556-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp209E.tmp

MD5 49082309e796620244b60ce7acde024d
SHA1 f69e835af2285740a69125c1c58725bcbdc44c93
SHA256 19689205aa30f887af971c7b93e5fa1cc8757bf2a1e4988a3d9d1ef720a8070b
SHA512 f5eeba34c62411820ed688b4ec1f24bff5f4c1b2f90a2a8c76f474ffc2cdf35281191758515ad33d71c8cd6342f5b805b93c43642b411261c01cdc30ed780cf9

memory/1896-570-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3792-571-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 d8040298e60e8233a56566ed0586e473
SHA1 53f54ad7a6c71a2b44bec28d3050ab8425322210
SHA256 b7e0d31db02c71407f3d4ef7617ed930b6991b2a3d1e74b6c08b43ec39e6e204
SHA512 afcb72dbf195d81794d57d2117fdc2c5331dd909af4c191667eb24b88425020e750e8cd56d3cd4220546828b275632042eaac279b23499750cf1527defa903c3

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 d379a10ccabb859fcde037ffbbd2ef48
SHA1 f3ad86ea70ebc5b0964a27ba61b5d80c200b1323
SHA256 8b9f57127f3eb475350b4e9959d862cea9663bc38a422496b145348cb09db31e
SHA512 4ffa6e0e7e0e1e113551e1865c1befb02427e89e9391a245a6ca6cc9b9b338f8ad7ec0769d64c670e2a17cda5ff5effe7cc1b45c3de0b6a3c00c6d0fd4215797

memory/3960-591-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1056-601-0x0000000005C40000-0x0000000005F94000-memory.dmp

memory/1056-611-0x0000000006200000-0x000000000624C000-memory.dmp

memory/1056-612-0x0000000074790000-0x00000000747DC000-memory.dmp

memory/1056-628-0x00000000073A0000-0x0000000007443000-memory.dmp

memory/2676-622-0x0000000074790000-0x00000000747DC000-memory.dmp

memory/1056-633-0x0000000007680000-0x0000000007691000-memory.dmp

memory/2676-634-0x0000000007260000-0x0000000007274000-memory.dmp

memory/1548-644-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3064-653-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3572-659-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 cf894f4cb7f43ee723626623c242c9b1
SHA1 bfe70dbfb6035788cba172b39acc47b019d22f31
SHA256 66b167acfe4b21dd7a969f5f3cf1b8679b7f4413665d0f06fb801fc63cb11d17
SHA512 25f1812dc6f4c09d253a7a6c62dc1fd59f3c442bf39bcf748465228e3356d3fadeebee4cb9ddfbd09e3180956a44f8e576fc8b88ad3a71394eabb108e369409a

memory/808-688-0x00000000061C0000-0x0000000006514000-memory.dmp

memory/3872-698-0x0000000000400000-0x000000000041B000-memory.dmp

memory/808-699-0x00000000066A0000-0x00000000066EC000-memory.dmp

memory/2588-700-0x0000000005210000-0x0000000005222000-memory.dmp

memory/808-701-0x0000000074A30000-0x0000000074A7C000-memory.dmp

memory/808-711-0x00000000078A0000-0x0000000007943000-memory.dmp

memory/3248-712-0x0000000074A30000-0x0000000074A7C000-memory.dmp

memory/808-722-0x0000000007B50000-0x0000000007B61000-memory.dmp

memory/808-723-0x0000000007BA0000-0x0000000007BB4000-memory.dmp

memory/2440-733-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3492-746-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2364-747-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Windows\directx.sys

MD5 7779b7aac555eb734d1d878a0dfce1e2
SHA1 4216e4f627f3933d918ae4b86683e205e630d3a5
SHA256 62263e548942d1b55bc1f1c79489ddf0fc111a11df3660b30e202a8472fc7331
SHA512 e9608bb14045f4789c367771fd2a043a13e9732dd3daa4bd41bed753f46d9e0334d4af9bff59a755e8511988dea3b3a88f887940a09668eff07eb7e4b2ad209b

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 5597ba3f03d447b6ab6d814b8a2076a0
SHA1 2664d1455bc6aac30d3c3562471d1bbc69ac5d82
SHA256 174b5217e818a75e0949f5646e0fac7118282dcffc0c632d802f01259517e6fc
SHA512 1772718c8f6d9a3c88079215ea56b1d5a9bb5f8717e593721d51aef39587d464f6769997983fa7362cc90c03f68da6e88458f9dc05f89114204d663e417743d8

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 8cc4cb98795f828c450a14f81ac01309
SHA1 6eb5e0f76fd8fca9b31e516a256f85375a5eec2b
SHA256 b582084a810ea324819ea9ec95017e5c188ea87c899013c08389fe111168a327
SHA512 4aac2ece69ebe0b23c7075eab7616fe4b2b5b6f6a2ba4ea83f0fa7236ad41be83cf549e40e51f9f027c93b93b8796e15e374f4b31008db9edd0695863f011509

memory/1672-767-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1428-777-0x00000000060D0000-0x0000000006424000-memory.dmp

memory/1428-787-0x0000000006530000-0x000000000657C000-memory.dmp

memory/1428-788-0x00000000708A0000-0x00000000708EC000-memory.dmp

memory/1428-798-0x0000000007740000-0x00000000077E3000-memory.dmp

memory/1908-799-0x00000000708A0000-0x00000000708EC000-memory.dmp

memory/1428-809-0x0000000007A00000-0x0000000007A11000-memory.dmp

memory/1428-810-0x0000000007A50000-0x0000000007A64000-memory.dmp

memory/3572-820-0x0000000000400000-0x000000000041B000-memory.dmp

memory/760-828-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3908-829-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 509bdca222ab96b96e2123b1d306c0d2
SHA1 f699b8e912eafeb889c79ffddac2b9df1f911e5a
SHA256 bd5abfab7d2d65c344de5c98be6d627c6da56ca6de2a61146a266f5490d6a43a
SHA512 45b8b2ab493674a39d0ef66b5af4a276c346b04c3bb49b2063d47d37e61c9d30cad335461d8064a65acc7b2684964799ed3064443589f3ceedeced7b40a528d2

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 833ae70f461fc884a4072d5b56cfa5f6
SHA1 f8251932662cd8ac66e26e4b58aa6828bcf391b0
SHA256 cee917f78c9273272d35a24c237438a91b8a4f375174a50215425d0e8640aa61
SHA512 4b810f42973271fdf59090b543239f01d12779f82a2f97a203ef68fc06c17474246829da9376b4c383b00b913b51461881bf88917d3d9a829c509a27be1ca947

memory/2716-849-0x0000000006410000-0x0000000006764000-memory.dmp

memory/3040-868-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1676-869-0x00000000056A0000-0x00000000056B2000-memory.dmp

memory/3936-870-0x0000000006A10000-0x0000000006A5C000-memory.dmp

memory/3936-871-0x0000000074F00000-0x0000000074F4C000-memory.dmp

memory/2716-881-0x0000000074F00000-0x0000000074F4C000-memory.dmp

memory/3936-891-0x0000000007950000-0x00000000079F3000-memory.dmp

memory/3936-892-0x0000000007C50000-0x0000000007C61000-memory.dmp

memory/3936-893-0x0000000007C80000-0x0000000007C94000-memory.dmp