Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-11-2024 00:33
Behavioral task
behavioral1
Sample
7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe
-
Size
253KB
-
MD5
d54b7905893774b4896e54bf5c75d790
-
SHA1
e074def1b0083e3ee24a264904891540d8101d12
-
SHA256
7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a
-
SHA512
8f99bfc222db409553af25bceb1ee3866f5a9dd4fead718b37da636f97c0a045346c4083cce566a8e383f37afa1751506aea8670feeb124e3ee19ef2c96cf96c
-
SSDEEP
3072:sr85CwBxR1qJmcv8fyOolexayyyyjU1eEYr85C:k9wBxRTcv8faIAH9
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
Processes:
resource yara_rule behavioral1/files/0x0008000000016210-6.dat family_neshta behavioral1/files/0x0008000000016334-15.dat family_neshta behavioral1/files/0x0001000000010314-20.dat family_neshta behavioral1/files/0x0001000000010312-19.dat family_neshta behavioral1/files/0x000700000001033a-18.dat family_neshta behavioral1/files/0x0022000000010678-17.dat family_neshta behavioral1/memory/1812-31-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1616-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2928-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2940-43-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2096-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2716-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2644-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2676-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1576-87-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2608-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2108-100-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1516-99-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1688-115-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1636-114-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1656-128-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f776-143.dat family_neshta behavioral1/files/0x000100000000f7d8-142.dat family_neshta behavioral1/files/0x000100000000f7d3-141.dat family_neshta behavioral1/memory/1804-129-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1816-157-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2832-156-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2944-173-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2316-172-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2232-192-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2088-193-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1364-204-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2816-203-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1492-219-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/564-220-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/700-224-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3068-231-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2372-241-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1020-240-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/856-255-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2344-256-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2360-277-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2400-276-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3036-294-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3064-293-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2720-303-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2732-302-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2700-318-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2620-317-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2972-331-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2492-330-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2980-338-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2968-339-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1444-347-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1692-346-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1920-354-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2544-355-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1524-367-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2000-368-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1656-371-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/352-370-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1004-379-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2584-378-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3012-387-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
Processes:
7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exesvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.compid Process 2276 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe 1616 svchost.com 1812 723254~1.EXE 2928 svchost.com 2940 723254~1.EXE 2096 svchost.com 2716 723254~1.EXE 2644 svchost.com 2676 723254~1.EXE 1576 svchost.com 2608 723254~1.EXE 2108 svchost.com 1516 723254~1.EXE 1636 svchost.com 1688 723254~1.EXE 1656 svchost.com 1804 723254~1.EXE 1816 svchost.com 2832 723254~1.EXE 2316 svchost.com 2944 723254~1.EXE 2232 svchost.com 2088 723254~1.EXE 1364 svchost.com 2816 723254~1.EXE 1492 svchost.com 564 723254~1.EXE 700 svchost.com 3068 723254~1.EXE 2372 svchost.com 1020 723254~1.EXE 2344 svchost.com 856 723254~1.EXE 2360 svchost.com 2400 723254~1.EXE 3036 svchost.com 3064 723254~1.EXE 2720 svchost.com 2732 723254~1.EXE 2700 svchost.com 2620 723254~1.EXE 2492 svchost.com 2972 723254~1.EXE 2968 svchost.com 2980 723254~1.EXE 1444 svchost.com 1692 723254~1.EXE 2544 svchost.com 1920 723254~1.EXE 2000 svchost.com 1524 723254~1.EXE 1656 svchost.com 352 723254~1.EXE 1004 svchost.com 2584 723254~1.EXE 3012 svchost.com 1816 723254~1.EXE 2852 svchost.com 852 723254~1.EXE 1356 svchost.com 1780 723254~1.EXE 1104 svchost.com 944 723254~1.EXE 1768 svchost.com -
Loads dropped DLL 64 IoCs
Processes:
7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.compid Process 1628 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe 1628 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe 1616 svchost.com 1616 svchost.com 2928 svchost.com 2928 svchost.com 2096 svchost.com 2096 svchost.com 2644 svchost.com 2644 svchost.com 1576 svchost.com 1576 svchost.com 2108 svchost.com 2108 svchost.com 1636 svchost.com 1636 svchost.com 1656 svchost.com 1656 svchost.com 1816 svchost.com 1816 svchost.com 1628 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe 2316 svchost.com 2316 svchost.com 2276 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe 2232 svchost.com 2232 svchost.com 1364 svchost.com 1364 svchost.com 1492 svchost.com 1492 svchost.com 2276 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe 700 svchost.com 700 svchost.com 2372 svchost.com 2372 svchost.com 2344 svchost.com 2344 svchost.com 2360 svchost.com 2360 svchost.com 1628 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe 3036 svchost.com 3036 svchost.com 2276 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe 2720 svchost.com 2720 svchost.com 2700 svchost.com 2700 svchost.com 2492 svchost.com 2492 svchost.com 2968 svchost.com 2968 svchost.com 1444 svchost.com 1444 svchost.com 2544 svchost.com 2544 svchost.com 2000 svchost.com 2000 svchost.com 1656 svchost.com 1656 svchost.com 1004 svchost.com 1004 svchost.com 3012 svchost.com 3012 svchost.com 2852 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exedescription ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe -
Drops file in Windows directory 64 IoCs
Processes:
svchost.comsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.comsvchost.com723254~1.EXEsvchost.com723254~1.EXE723254~1.EXE723254~1.EXE723254~1.EXEsvchost.comsvchost.com723254~1.EXE723254~1.EXEsvchost.comsvchost.com723254~1.EXE723254~1.EXEsvchost.comsvchost.comsvchost.com723254~1.EXEsvchost.comsvchost.com723254~1.EXE723254~1.EXE723254~1.EXE723254~1.EXEsvchost.com723254~1.EXEsvchost.comsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXE723254~1.EXE723254~1.EXEsvchost.comsvchost.com723254~1.EXEsvchost.comsvchost.comsvchost.com723254~1.EXE723254~1.EXE723254~1.EXEsvchost.comsvchost.com723254~1.EXE723254~1.EXE7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe723254~1.EXEsvchost.comsvchost.comsvchost.com723254~1.EXEsvchost.com723254~1.EXEdescription ioc Process File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 723254~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 723254~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 723254~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 723254~1.EXE File opened for modification C:\Windows\directx.sys 723254~1.EXE File opened for modification C:\Windows\svchost.com 723254~1.EXE File opened for modification C:\Windows\svchost.com 723254~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 723254~1.EXE File opened for modification C:\Windows\directx.sys 723254~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 723254~1.EXE File opened for modification C:\Windows\svchost.com 723254~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 723254~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 723254~1.EXE File opened for modification C:\Windows\svchost.com 723254~1.EXE File opened for modification C:\Windows\svchost.com 723254~1.EXE File opened for modification C:\Windows\svchost.com 723254~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 723254~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 723254~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 723254~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 723254~1.EXE File opened for modification C:\Windows\directx.sys 723254~1.EXE File opened for modification C:\Windows\directx.sys 723254~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 723254~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 723254~1.EXE File opened for modification C:\Windows\directx.sys 723254~1.EXE File opened for modification C:\Windows\svchost.com 723254~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 723254~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 723254~1.EXE File opened for modification C:\Windows\svchost.com 723254~1.EXE File opened for modification C:\Windows\svchost.com 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe File opened for modification C:\Windows\directx.sys 723254~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 723254~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 723254~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
723254~1.EXE723254~1.EXE723254~1.EXEsvchost.com723254~1.EXE723254~1.EXE723254~1.EXE723254~1.EXE723254~1.EXE723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.comsvchost.comsvchost.com723254~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com723254~1.EXE723254~1.EXE723254~1.EXE723254~1.EXEsvchost.comsvchost.com723254~1.EXE723254~1.EXE723254~1.EXE723254~1.EXE723254~1.EXE723254~1.EXE723254~1.EXE723254~1.EXEsvchost.com723254~1.EXE723254~1.EXEsvchost.comsvchost.comsvchost.com723254~1.EXEsvchost.comsvchost.com723254~1.EXE723254~1.EXE723254~1.EXE723254~1.EXEsvchost.com723254~1.EXEsvchost.comsvchost.com723254~1.EXE723254~1.EXEsvchost.comsvchost.comsvchost.com723254~1.EXE723254~1.EXEsvchost.comdescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723254~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
Processes:
7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
723254~1.EXEpid Process 1908 723254~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exesvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEsvchost.com723254~1.EXEdescription pid Process procid_target PID 1628 wrote to memory of 2276 1628 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe 28 PID 1628 wrote to memory of 2276 1628 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe 28 PID 1628 wrote to memory of 2276 1628 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe 28 PID 1628 wrote to memory of 2276 1628 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe 28 PID 2276 wrote to memory of 1616 2276 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe 29 PID 2276 wrote to memory of 1616 2276 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe 29 PID 2276 wrote to memory of 1616 2276 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe 29 PID 2276 wrote to memory of 1616 2276 7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe 29 PID 1616 wrote to memory of 1812 1616 svchost.com 30 PID 1616 wrote to memory of 1812 1616 svchost.com 30 PID 1616 wrote to memory of 1812 1616 svchost.com 30 PID 1616 wrote to memory of 1812 1616 svchost.com 30 PID 1812 wrote to memory of 2928 1812 723254~1.EXE 31 PID 1812 wrote to memory of 2928 1812 723254~1.EXE 31 PID 1812 wrote to memory of 2928 1812 723254~1.EXE 31 PID 1812 wrote to memory of 2928 1812 723254~1.EXE 31 PID 2928 wrote to memory of 2940 2928 svchost.com 32 PID 2928 wrote to memory of 2940 2928 svchost.com 32 PID 2928 wrote to memory of 2940 2928 svchost.com 32 PID 2928 wrote to memory of 2940 2928 svchost.com 32 PID 2940 wrote to memory of 2096 2940 723254~1.EXE 33 PID 2940 wrote to memory of 2096 2940 723254~1.EXE 33 PID 2940 wrote to memory of 2096 2940 723254~1.EXE 33 PID 2940 wrote to memory of 2096 2940 723254~1.EXE 33 PID 2096 wrote to memory of 2716 2096 svchost.com 34 PID 2096 wrote to memory of 2716 2096 svchost.com 34 PID 2096 wrote to memory of 2716 2096 svchost.com 34 PID 2096 wrote to memory of 2716 2096 svchost.com 34 PID 2716 wrote to memory of 2644 2716 723254~1.EXE 35 PID 2716 wrote to memory of 2644 2716 723254~1.EXE 35 PID 2716 wrote to memory of 2644 2716 723254~1.EXE 35 PID 2716 wrote to memory of 2644 2716 723254~1.EXE 35 PID 2644 wrote to memory of 2676 2644 svchost.com 36 PID 2644 wrote to memory of 2676 2644 svchost.com 36 PID 2644 wrote to memory of 2676 2644 svchost.com 36 PID 2644 wrote to memory of 2676 2644 svchost.com 36 PID 2676 wrote to memory of 1576 2676 723254~1.EXE 37 PID 2676 wrote to memory of 1576 2676 723254~1.EXE 37 PID 2676 wrote to memory of 1576 2676 723254~1.EXE 37 PID 2676 wrote to memory of 1576 2676 723254~1.EXE 37 PID 1576 wrote to memory of 2608 1576 svchost.com 38 PID 1576 wrote to memory of 2608 1576 svchost.com 38 PID 1576 wrote to memory of 2608 1576 svchost.com 38 PID 1576 wrote to memory of 2608 1576 svchost.com 38 PID 2608 wrote to memory of 2108 2608 723254~1.EXE 39 PID 2608 wrote to memory of 2108 2608 723254~1.EXE 39 PID 2608 wrote to memory of 2108 2608 723254~1.EXE 39 PID 2608 wrote to memory of 2108 2608 723254~1.EXE 39 PID 2108 wrote to memory of 1516 2108 svchost.com 40 PID 2108 wrote to memory of 1516 2108 svchost.com 40 PID 2108 wrote to memory of 1516 2108 svchost.com 40 PID 2108 wrote to memory of 1516 2108 svchost.com 40 PID 1516 wrote to memory of 1636 1516 723254~1.EXE 124 PID 1516 wrote to memory of 1636 1516 723254~1.EXE 124 PID 1516 wrote to memory of 1636 1516 723254~1.EXE 124 PID 1516 wrote to memory of 1636 1516 723254~1.EXE 124 PID 1636 wrote to memory of 1688 1636 svchost.com 42 PID 1636 wrote to memory of 1688 1636 svchost.com 42 PID 1636 wrote to memory of 1688 1636 svchost.com 42 PID 1636 wrote to memory of 1688 1636 svchost.com 42 PID 1688 wrote to memory of 1656 1688 723254~1.EXE 79 PID 1688 wrote to memory of 1656 1688 723254~1.EXE 79 PID 1688 wrote to memory of 1656 1688 723254~1.EXE 79 PID 1688 wrote to memory of 1656 1688 723254~1.EXE 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe"C:\Users\Admin\AppData\Local\Temp\7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\7232543634b98df35a0352a8f936a296635cf86c241656a431f49dfe6b9f4e1a.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE10⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE14⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE18⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1804 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2832 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE22⤵
- Executes dropped EXE
PID:2944 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE24⤵
- Executes dropped EXE
PID:2088 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE26⤵
- Executes dropped EXE
PID:2816 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE28⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:564 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE30⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3068 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE32⤵
- Executes dropped EXE
PID:1020 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE34⤵
- Executes dropped EXE
PID:856 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE36⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2400 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE38⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3064 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2732 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE42⤵
- Executes dropped EXE
PID:2620 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE44⤵
- Executes dropped EXE
PID:2972 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2980 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE48⤵
- Executes dropped EXE
PID:1692 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE50⤵
- Executes dropped EXE
PID:1920 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE52⤵
- Executes dropped EXE
PID:1524 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE54⤵
- Executes dropped EXE
PID:352 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE56⤵
- Executes dropped EXE
PID:2584 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1816 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE60⤵
- Executes dropped EXE
PID:852 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE62⤵
- Executes dropped EXE
PID:1780 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"63⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE64⤵
- Executes dropped EXE
PID:944 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"65⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE66⤵PID:1288
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"67⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE68⤵
- System Location Discovery: System Language Discovery
PID:1784 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"69⤵
- System Location Discovery: System Language Discovery
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE70⤵PID:1040
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"71⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE72⤵PID:1904
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"73⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE74⤵PID:872
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"75⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE76⤵
- System Location Discovery: System Language Discovery
PID:1224 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"77⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE78⤵PID:1704
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"79⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE80⤵PID:2916
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"81⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE82⤵
- Drops file in Windows directory
PID:2068 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"83⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE84⤵
- Drops file in Windows directory
PID:2704 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"85⤵
- Drops file in Windows directory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE86⤵
- System Location Discovery: System Language Discovery
PID:2596 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"87⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE88⤵PID:2748
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"89⤵
- Drops file in Windows directory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE90⤵PID:2476
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"91⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE92⤵PID:2152
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"93⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE94⤵
- System Location Discovery: System Language Discovery
PID:2480 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"95⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE96⤵
- System Location Discovery: System Language Discovery
PID:464 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"97⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE98⤵PID:1636
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"99⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE100⤵PID:1804
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"101⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE102⤵PID:2804
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"103⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE104⤵
- Drops file in Windows directory
PID:1004 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"105⤵
- System Location Discovery: System Language Discovery
PID:908 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE106⤵PID:3012
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"107⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE108⤵PID:852
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"109⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE110⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1780 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"111⤵
- Drops file in Windows directory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE112⤵PID:304
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"113⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE114⤵PID:1396
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"115⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE116⤵PID:2112
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"117⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE118⤵PID:1716
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"119⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE120⤵PID:3068
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\723254~1.EXE"121⤵PID:1436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-