Analysis
-
max time kernel
148s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/11/2024, 02:10
Behavioral task
behavioral1
Sample
1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe
Resource
win7-20240903-en
windows7-x64
20 signatures
150 seconds
General
-
Target
1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe
-
Size
2.3MB
-
MD5
c2178d8b3bdcf1210181170012e95b83
-
SHA1
1a6e51b004c5384c0af7882229f6a949395d588a
-
SHA256
1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1
-
SHA512
c99ca875c22893d98bbb11fd70eacbad3e180e78f55abc9421db350db91c58428b52398678db0ccbfe9942ce9bf2775a61af9f1d709ca87c7f08c8b62c45fa5a
-
SSDEEP
24576:dFbkIsaPiXSVnC7Yp9zkNmZG8RRln4yzrIila8CfcX50Kew+IVWQPYwKBdzuyMrt:dREXSVMDi3w0aFIP+DwKnwhFltZ
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0008000000015d07-2.dat family_neshta behavioral1/files/0x0001000000010318-10.dat family_neshta behavioral1/files/0x0008000000015da1-27.dat family_neshta behavioral1/files/0x0001000000010316-51.dat family_neshta behavioral1/memory/1592-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x001400000000f842-50.dat family_neshta behavioral1/files/0x005b00000001032b-49.dat family_neshta behavioral1/files/0x0008000000015d19-48.dat family_neshta behavioral1/files/0x000100000000f7cf-66.dat family_neshta behavioral1/memory/1052-82-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7eb-70.dat family_neshta behavioral1/files/0x000100000000f877-89.dat family_neshta behavioral1/files/0x00010000000118e7-103.dat family_neshta behavioral1/files/0x0001000000011b5b-109.dat family_neshta behavioral1/files/0x0003000000012145-136.dat family_neshta behavioral1/files/0x0003000000012148-135.dat family_neshta behavioral1/files/0x0003000000012186-131.dat family_neshta behavioral1/files/0x0003000000012184-139.dat family_neshta behavioral1/files/0x00010000000108fa-116.dat family_neshta behavioral1/memory/2932-140-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2052-115-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x0002000000011813-152.dat family_neshta behavioral1/files/0x0001000000010b11-161.dat family_neshta behavioral1/files/0x0002000000010928-150.dat family_neshta behavioral1/memory/1900-149-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1832-169-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x00010000000115d0-170.dat family_neshta behavioral1/memory/1864-181-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1696-202-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/580-209-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/996-215-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2032-224-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1992-231-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1376-233-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x0001000000010f34-101.dat family_neshta behavioral1/memory/1520-239-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2920-241-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2068-247-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1648-249-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2080-255-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2856-257-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1592-263-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2636-265-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/536-271-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2096-273-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/484-279-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1924-99-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2008-281-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/576-287-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2108-289-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x0001000000010c16-97.dat family_neshta behavioral1/memory/2512-295-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1636-298-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2516-303-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2120-305-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2128-311-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1168-318-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1448-319-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1832-321-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/840-327-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2016-334-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/660-335-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2364-342-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/940-343-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x0007000000015d68-17.dat family_gh0strat -
Gh0strat family
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\259450925.bat" look2.exe -
Executes dropped EXE 64 IoCs
pid Process 2832 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 2916 look2.exe 2848 HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 1592 svchost.com 1052 HD_1D5~1.EXE 1924 svchost.com 2052 HD_1D5~1.EXE 2932 svchost.com 1900 HD_1D5~1.EXE 1832 svchost.com 1864 HD_1D5~1.EXE 1696 svchost.com 580 HD_1D5~1.EXE 996 svchost.com 2032 HD_1D5~1.EXE 1992 svchost.com 1376 HD_1D5~1.EXE 1520 svchost.com 2920 HD_1D5~1.EXE 2068 svchost.com 1648 HD_1D5~1.EXE 2080 svchost.com 2856 HD_1D5~1.EXE 1592 svchost.com 2636 HD_1D5~1.EXE 536 svchost.com 2096 HD_1D5~1.EXE 484 svchost.com 2008 HD_1D5~1.EXE 576 svchost.com 2108 HD_1D5~1.EXE 2512 svchost.com 1636 HD_1D5~1.EXE 2516 svchost.com 2120 HD_1D5~1.EXE 2128 svchost.com 1168 HD_1D5~1.EXE 1448 svchost.com 1832 HD_1D5~1.EXE 840 svchost.com 2016 HD_1D5~1.EXE 660 svchost.com 2364 HD_1D5~1.EXE 940 svchost.com 984 HD_1D5~1.EXE 996 svchost.com 2320 HD_1D5~1.EXE 1092 svchcst.exe 2032 svchost.com 1856 HD_1D5~1.EXE 1376 svchost.com 1496 HD_1D5~1.EXE 2344 svchost.com 2860 HD_1D5~1.EXE 2580 svchost.com 2080 HD_1D5~1.EXE 2856 svchost.com 1504 HD_1D5~1.EXE 2900 svchost.com 2796 HD_1D5~1.EXE 1000 svchost.com 2600 HD_1D5~1.EXE 1708 svchost.com 2256 HD_1D5~1.EXE -
Loads dropped DLL 64 IoCs
pid Process 2112 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 2832 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 2916 look2.exe 2868 svchost.exe 2832 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 2832 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 1592 svchost.com 1592 svchost.com 2848 HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 2112 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 2112 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 2848 HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 2848 HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 1924 svchost.com 1924 svchost.com 2848 HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 2932 svchost.com 2932 svchost.com 2848 HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 1832 svchost.com 1832 svchost.com 2848 HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 1696 svchost.com 2848 HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 1696 svchost.com 996 svchost.com 996 svchost.com 1992 svchost.com 1992 svchost.com 1520 svchost.com 1520 svchost.com 2068 svchost.com 2068 svchost.com 2080 svchost.com 2080 svchost.com 1592 svchost.com 1592 svchost.com 536 svchost.com 536 svchost.com 484 svchost.com 484 svchost.com 576 svchost.com 576 svchost.com 2512 svchost.com 2512 svchost.com 2516 svchost.com 2516 svchost.com 2128 svchost.com 2128 svchost.com 1448 svchost.com 1448 svchost.com 840 svchost.com 840 svchost.com 660 svchost.com 660 svchost.com 940 svchost.com 940 svchost.com 996 svchost.com 996 svchost.com 2868 svchost.exe 1092 svchcst.exe 2032 svchost.com 2032 svchost.com 1376 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ini.ini look2.exe File created C:\Windows\SysWOW64\svchcst.exe svchost.exe File opened for modification C:\Windows\SysWOW64\svchcst.exe svchost.exe File created C:\Windows\SysWOW64\259450925.bat look2.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language look2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2832 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2832 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 2832 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 2960 HD_1D5~1.EXE 2960 HD_1D5~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2832 2112 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 31 PID 2112 wrote to memory of 2832 2112 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 31 PID 2112 wrote to memory of 2832 2112 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 31 PID 2112 wrote to memory of 2832 2112 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 31 PID 2832 wrote to memory of 2916 2832 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 32 PID 2832 wrote to memory of 2916 2832 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 32 PID 2832 wrote to memory of 2916 2832 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 32 PID 2832 wrote to memory of 2916 2832 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 32 PID 2832 wrote to memory of 2848 2832 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 35 PID 2832 wrote to memory of 2848 2832 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 35 PID 2832 wrote to memory of 2848 2832 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 35 PID 2832 wrote to memory of 2848 2832 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 35 PID 2848 wrote to memory of 1592 2848 HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 56 PID 2848 wrote to memory of 1592 2848 HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 56 PID 2848 wrote to memory of 1592 2848 HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 56 PID 2848 wrote to memory of 1592 2848 HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 56 PID 1592 wrote to memory of 1052 1592 svchost.com 37 PID 1592 wrote to memory of 1052 1592 svchost.com 37 PID 1592 wrote to memory of 1052 1592 svchost.com 37 PID 1592 wrote to memory of 1052 1592 svchost.com 37 PID 1052 wrote to memory of 1924 1052 HD_1D5~1.EXE 38 PID 1052 wrote to memory of 1924 1052 HD_1D5~1.EXE 38 PID 1052 wrote to memory of 1924 1052 HD_1D5~1.EXE 38 PID 1052 wrote to memory of 1924 1052 HD_1D5~1.EXE 38 PID 1924 wrote to memory of 2052 1924 svchost.com 39 PID 1924 wrote to memory of 2052 1924 svchost.com 39 PID 1924 wrote to memory of 2052 1924 svchost.com 39 PID 1924 wrote to memory of 2052 1924 svchost.com 39 PID 2052 wrote to memory of 2932 2052 HD_1D5~1.EXE 40 PID 2052 wrote to memory of 2932 2052 HD_1D5~1.EXE 40 PID 2052 wrote to memory of 2932 2052 HD_1D5~1.EXE 40 PID 2052 wrote to memory of 2932 2052 HD_1D5~1.EXE 40 PID 2932 wrote to memory of 1900 2932 svchost.com 41 PID 2932 wrote to memory of 1900 2932 svchost.com 41 PID 2932 wrote to memory of 1900 2932 svchost.com 41 PID 2932 wrote to memory of 1900 2932 svchost.com 41 PID 1900 wrote to memory of 1832 1900 HD_1D5~1.EXE 71 PID 1900 wrote to memory of 1832 1900 HD_1D5~1.EXE 71 PID 1900 wrote to memory of 1832 1900 HD_1D5~1.EXE 71 PID 1900 wrote to memory of 1832 1900 HD_1D5~1.EXE 71 PID 1832 wrote to memory of 1864 1832 svchost.com 43 PID 1832 wrote to memory of 1864 1832 svchost.com 43 PID 1832 wrote to memory of 1864 1832 svchost.com 43 PID 1832 wrote to memory of 1864 1832 svchost.com 43 PID 1864 wrote to memory of 1696 1864 HD_1D5~1.EXE 44 PID 1864 wrote to memory of 1696 1864 HD_1D5~1.EXE 44 PID 1864 wrote to memory of 1696 1864 HD_1D5~1.EXE 44 PID 1864 wrote to memory of 1696 1864 HD_1D5~1.EXE 44 PID 1696 wrote to memory of 580 1696 svchost.com 45 PID 1696 wrote to memory of 580 1696 svchost.com 45 PID 1696 wrote to memory of 580 1696 svchost.com 45 PID 1696 wrote to memory of 580 1696 svchost.com 45 PID 580 wrote to memory of 996 580 HD_1D5~1.EXE 145 PID 580 wrote to memory of 996 580 HD_1D5~1.EXE 145 PID 580 wrote to memory of 996 580 HD_1D5~1.EXE 145 PID 580 wrote to memory of 996 580 HD_1D5~1.EXE 145 PID 996 wrote to memory of 2032 996 svchost.com 81 PID 996 wrote to memory of 2032 996 svchost.com 81 PID 996 wrote to memory of 2032 996 svchost.com 81 PID 996 wrote to memory of 2032 996 svchost.com 81 PID 2032 wrote to memory of 1992 2032 HD_1D5~1.EXE 48 PID 2032 wrote to memory of 1992 2032 HD_1D5~1.EXE 48 PID 2032 wrote to memory of 1992 2032 HD_1D5~1.EXE 48 PID 2032 wrote to memory of 1992 2032 HD_1D5~1.EXE 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe"C:\Users\Admin\AppData\Local\Temp\1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\look2.exeC:\Users\Admin\AppData\Local\Temp\\look2.exe3⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2916
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE17⤵
- Executes dropped EXE
PID:1376 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2920 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE21⤵
- Executes dropped EXE
PID:1648 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE23⤵
- Executes dropped EXE
PID:2856 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE25⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2636 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE27⤵
- Executes dropped EXE
PID:2096 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:484 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE29⤵
- Executes dropped EXE
PID:2008 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2108 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"32⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE33⤵
- Executes dropped EXE
PID:1636 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE35⤵
- Executes dropped EXE
PID:2120 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1168 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"38⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE39⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1832 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE41⤵
- Executes dropped EXE
PID:2016 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:660 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2364 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE45⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:984 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE47⤵
- Executes dropped EXE
PID:2320 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1856 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1496 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"52⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE53⤵
- Executes dropped EXE
PID:2860 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"54⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE55⤵
- Executes dropped EXE
PID:2080 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"56⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE57⤵
- Executes dropped EXE
PID:1504 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"58⤵
- Executes dropped EXE
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE59⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2796 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"60⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE61⤵
- Executes dropped EXE
PID:2600 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"62⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE63⤵
- Executes dropped EXE
PID:2256 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"64⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE65⤵
- System Location Discovery: System Language Discovery
PID:2512 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"66⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE67⤵PID:2516
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"68⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE69⤵PID:2128
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"70⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE71⤵PID:2064
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"72⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE73⤵PID:1260
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"74⤵
- Drops file in Windows directory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE75⤵PID:1736
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"76⤵
- System Location Discovery: System Language Discovery
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE77⤵PID:2020
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"78⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE79⤵PID:1980
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"80⤵
- System Location Discovery: System Language Discovery
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE81⤵PID:1436
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"82⤵
- System Location Discovery: System Language Discovery
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE83⤵PID:1376
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"84⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE85⤵
- Drops file in Windows directory
PID:2344 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"86⤵
- System Location Discovery: System Language Discovery
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE87⤵PID:2548
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"88⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE89⤵PID:1872
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"90⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE91⤵
- System Location Discovery: System Language Discovery
PID:2096 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"92⤵
- System Location Discovery: System Language Discovery
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE93⤵
- Drops file in Windows directory
PID:2632 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"94⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE95⤵PID:2008
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"96⤵
- Drops file in Windows directory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE97⤵PID:1836
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"98⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE99⤵PID:2332
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"100⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE101⤵PID:2120
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"102⤵
- Drops file in Windows directory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE103⤵PID:1292
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"104⤵
- Drops file in Windows directory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE105⤵PID:1464
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"106⤵
- System Location Discovery: System Language Discovery
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE107⤵PID:1584
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"108⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE109⤵PID:2072
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"110⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE111⤵PID:1908
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"112⤵
- Drops file in Windows directory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE113⤵PID:2452
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"114⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE115⤵PID:792
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"116⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE117⤵PID:2824
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"118⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE119⤵PID:2836
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"120⤵
- Drops file in Windows directory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE121⤵PID:2548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-