Analysis
-
max time kernel
134s -
max time network
118s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-12-2021 05:00
Static task
static1
Behavioral task
behavioral1
Sample
tmp/25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
tmp/25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe
Resource
win10-en-20211208
General
-
Target
tmp/25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe
-
Size
2.3MB
-
MD5
687cb42f614773145b672ea5de18aa2c
-
SHA1
3aa9bc7bb65d8b3cc4fb2dd11ef3603b458ead02
-
SHA256
be4ae8c97d86406b0b6cda20d56f7a6293d99d7a6d72152fc895e23b346e55f6
-
SHA512
a9410acc4a22af14dac93653d18543733a6453a8d8f70eaef7582c598784ef16aa02cf0cd673eebc434f736a49f2f76997e1ac6ecfa3e86114b72424932d6b75
Malware Config
Signatures
-
Detect Neshta Payload 38 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\tmp\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta \Users\Admin\AppData\Local\Temp\tmp\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta C:\Users\Admin\AppData\Local\Temp\tmp\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta C:\Users\Admin\AppData\Local\Temp\tmp\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
svchost.exe25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exesvchost.exe25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exesvchost.exe25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exesvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEpid process 1524 svchost.exe 976 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe 752 svchost.exe 572 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe 1420 svchost.exe 1912 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe 1768 svchost.com 1928 25AEFF~1.EXE 1824 svchost.com 2040 25AEFF~1.EXE 1004 svchost.com 1344 25AEFF~1.EXE 1860 svchost.com 1428 25AEFF~1.EXE 1988 svchost.com 1700 25AEFF~1.EXE 1320 svchost.com 1592 25AEFF~1.EXE 1604 svchost.com 1524 25AEFF~1.EXE 1240 svchost.com 1412 25AEFF~1.EXE 1816 svchost.com 2032 25AEFF~1.EXE 1708 svchost.com 1476 25AEFF~1.EXE 1892 svchost.com 1740 25AEFF~1.EXE 2040 svchost.com 1852 25AEFF~1.EXE 2000 svchost.com 1508 25AEFF~1.EXE 1984 svchost.com 296 25AEFF~1.EXE 892 svchost.com 1628 25AEFF~1.EXE 1700 svchost.com 1500 25AEFF~1.EXE 1480 svchost.com 1320 25AEFF~1.EXE 268 svchost.com 664 25AEFF~1.EXE 1128 svchost.com 860 25AEFF~1.EXE 972 svchost.com 1412 25AEFF~1.EXE 1784 svchost.com 2032 25AEFF~1.EXE 980 svchost.com 1708 25AEFF~1.EXE 1744 svchost.com 1892 25AEFF~1.EXE 1844 svchost.com 2040 25AEFF~1.EXE 2036 svchost.com 556 25AEFF~1.EXE 2028 svchost.com 1668 25AEFF~1.EXE 1840 svchost.com 1388 25AEFF~1.EXE 1316 svchost.com 1616 25AEFF~1.EXE 580 svchost.com 912 25AEFF~1.EXE -
Loads dropped DLL 64 IoCs
Processes:
svchost.exe25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exesvchost.exe25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.compid process 1524 svchost.exe 1524 svchost.exe 976 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe 976 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe 976 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe 1420 svchost.exe 1420 svchost.exe 1912 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe 1912 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe 1768 svchost.com 1768 svchost.com 1824 svchost.com 1824 svchost.com 1004 svchost.com 1004 svchost.com 1860 svchost.com 1860 svchost.com 1988 svchost.com 1988 svchost.com 1320 svchost.com 1320 svchost.com 976 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe 1912 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe 1604 svchost.com 1604 svchost.com 1240 svchost.com 1240 svchost.com 1816 svchost.com 1816 svchost.com 1708 svchost.com 1708 svchost.com 1892 svchost.com 1892 svchost.com 976 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe 2040 svchost.com 2040 svchost.com 2000 svchost.com 2000 svchost.com 1984 svchost.com 1984 svchost.com 892 svchost.com 892 svchost.com 1700 svchost.com 1700 svchost.com 1480 svchost.com 1480 svchost.com 268 svchost.com 268 svchost.com 1128 svchost.com 1128 svchost.com 972 svchost.com 972 svchost.com 1784 svchost.com 1784 svchost.com 980 svchost.com 980 svchost.com 1744 svchost.com 1744 svchost.com 1844 svchost.com 1844 svchost.com 2036 svchost.com 2036 svchost.com 2028 svchost.com 2028 svchost.com -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exesvchost.exe25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exedescription ioc process File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe -
Drops file in Windows directory 64 IoCs
Processes:
25AEFF~1.EXEsvchost.com25AEFF~1.EXE25AEFF~1.EXEsvchost.comsvchost.com25AEFF~1.EXEsvchost.comsvchost.com25AEFF~1.EXE25AEFF~1.EXEsvchost.comsvchost.comsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXE25AEFF~1.EXEsvchost.com25AEFF~1.EXE25AEFF~1.EXE25AEFF~1.EXE25AEFF~1.EXEsvchost.comsvchost.com25AEFF~1.EXE25AEFF~1.EXE25AEFF~1.EXE25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.comsvchost.comsvchost.com25AEFF~1.EXE25AEFF~1.EXE25AEFF~1.EXE25AEFF~1.EXEsvchost.comsvchost.comsvchost.com25AEFF~1.EXEsvchost.comsvchost.comsvchost.com25AEFF~1.EXE25AEFF~1.EXE25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.comsvchost.comsvchost.comsvchost.com25AEFF~1.EXE25AEFF~1.EXEsvchost.comdescription ioc process File opened for modification C:\Windows\svchost.com 25AEFF~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 25AEFF~1.EXE File opened for modification C:\Windows\svchost.com 25AEFF~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 25AEFF~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 25AEFF~1.EXE File opened for modification C:\Windows\directx.sys 25AEFF~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 25AEFF~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 25AEFF~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 25AEFF~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 25AEFF~1.EXE File opened for modification C:\Windows\svchost.com 25AEFF~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 25AEFF~1.EXE File opened for modification C:\Windows\svchost.com 25AEFF~1.EXE File opened for modification C:\Windows\directx.sys 25AEFF~1.EXE File opened for modification C:\Windows\svchost.com 25AEFF~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 25AEFF~1.EXE File opened for modification C:\Windows\directx.sys 25AEFF~1.EXE File opened for modification C:\Windows\svchost.com 25AEFF~1.EXE File opened for modification C:\Windows\svchost.com 25AEFF~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 25AEFF~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 25AEFF~1.EXE File opened for modification C:\Windows\directx.sys 25AEFF~1.EXE File opened for modification C:\Windows\directx.sys 25AEFF~1.EXE File opened for modification C:\Windows\directx.sys 25AEFF~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 25AEFF~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 25AEFF~1.EXE File opened for modification C:\Windows\directx.sys 25AEFF~1.EXE File opened for modification C:\Windows\svchost.com 25AEFF~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 25AEFF~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 25AEFF~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 25AEFF~1.EXE File opened for modification C:\Windows\svchost.com 25AEFF~1.EXE File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exesvchost.exe25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exesvchost.exe25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exesvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEsvchost.com25AEFF~1.EXEdescription pid process target process PID 1592 wrote to memory of 1524 1592 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe svchost.exe PID 1592 wrote to memory of 1524 1592 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe svchost.exe PID 1592 wrote to memory of 1524 1592 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe svchost.exe PID 1592 wrote to memory of 1524 1592 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe svchost.exe PID 1524 wrote to memory of 976 1524 svchost.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe PID 1524 wrote to memory of 976 1524 svchost.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe PID 1524 wrote to memory of 976 1524 svchost.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe PID 1524 wrote to memory of 976 1524 svchost.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe PID 976 wrote to memory of 572 976 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe PID 976 wrote to memory of 572 976 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe PID 976 wrote to memory of 572 976 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe PID 976 wrote to memory of 572 976 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe PID 572 wrote to memory of 1420 572 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe svchost.exe PID 572 wrote to memory of 1420 572 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe svchost.exe PID 572 wrote to memory of 1420 572 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe svchost.exe PID 572 wrote to memory of 1420 572 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe svchost.exe PID 1420 wrote to memory of 1912 1420 svchost.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe PID 1420 wrote to memory of 1912 1420 svchost.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe PID 1420 wrote to memory of 1912 1420 svchost.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe PID 1420 wrote to memory of 1912 1420 svchost.exe 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe PID 1912 wrote to memory of 1768 1912 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe svchost.com PID 1912 wrote to memory of 1768 1912 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe svchost.com PID 1912 wrote to memory of 1768 1912 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe svchost.com PID 1912 wrote to memory of 1768 1912 25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe svchost.com PID 1768 wrote to memory of 1928 1768 svchost.com 25AEFF~1.EXE PID 1768 wrote to memory of 1928 1768 svchost.com 25AEFF~1.EXE PID 1768 wrote to memory of 1928 1768 svchost.com 25AEFF~1.EXE PID 1768 wrote to memory of 1928 1768 svchost.com 25AEFF~1.EXE PID 1928 wrote to memory of 1824 1928 25AEFF~1.EXE svchost.com PID 1928 wrote to memory of 1824 1928 25AEFF~1.EXE svchost.com PID 1928 wrote to memory of 1824 1928 25AEFF~1.EXE svchost.com PID 1928 wrote to memory of 1824 1928 25AEFF~1.EXE svchost.com PID 1824 wrote to memory of 2040 1824 svchost.com 25AEFF~1.EXE PID 1824 wrote to memory of 2040 1824 svchost.com 25AEFF~1.EXE PID 1824 wrote to memory of 2040 1824 svchost.com 25AEFF~1.EXE PID 1824 wrote to memory of 2040 1824 svchost.com 25AEFF~1.EXE PID 2040 wrote to memory of 1004 2040 25AEFF~1.EXE svchost.com PID 2040 wrote to memory of 1004 2040 25AEFF~1.EXE svchost.com PID 2040 wrote to memory of 1004 2040 25AEFF~1.EXE svchost.com PID 2040 wrote to memory of 1004 2040 25AEFF~1.EXE svchost.com PID 1004 wrote to memory of 1344 1004 svchost.com 25AEFF~1.EXE PID 1004 wrote to memory of 1344 1004 svchost.com 25AEFF~1.EXE PID 1004 wrote to memory of 1344 1004 svchost.com 25AEFF~1.EXE PID 1004 wrote to memory of 1344 1004 svchost.com 25AEFF~1.EXE PID 1344 wrote to memory of 1860 1344 25AEFF~1.EXE svchost.com PID 1344 wrote to memory of 1860 1344 25AEFF~1.EXE svchost.com PID 1344 wrote to memory of 1860 1344 25AEFF~1.EXE svchost.com PID 1344 wrote to memory of 1860 1344 25AEFF~1.EXE svchost.com PID 1860 wrote to memory of 1428 1860 svchost.com 25AEFF~1.EXE PID 1860 wrote to memory of 1428 1860 svchost.com 25AEFF~1.EXE PID 1860 wrote to memory of 1428 1860 svchost.com 25AEFF~1.EXE PID 1860 wrote to memory of 1428 1860 svchost.com 25AEFF~1.EXE PID 1428 wrote to memory of 1988 1428 25AEFF~1.EXE svchost.com PID 1428 wrote to memory of 1988 1428 25AEFF~1.EXE svchost.com PID 1428 wrote to memory of 1988 1428 25AEFF~1.EXE svchost.com PID 1428 wrote to memory of 1988 1428 25AEFF~1.EXE svchost.com PID 1988 wrote to memory of 1700 1988 svchost.com 25AEFF~1.EXE PID 1988 wrote to memory of 1700 1988 svchost.com 25AEFF~1.EXE PID 1988 wrote to memory of 1700 1988 svchost.com 25AEFF~1.EXE PID 1988 wrote to memory of 1700 1988 svchost.com 25AEFF~1.EXE PID 1700 wrote to memory of 1320 1700 25AEFF~1.EXE svchost.com PID 1700 wrote to memory of 1320 1700 25AEFF~1.EXE svchost.com PID 1700 wrote to memory of 1320 1700 25AEFF~1.EXE svchost.com PID 1700 wrote to memory of 1320 1700 25AEFF~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe"C:\Users\Admin\AppData\Local\Temp\tmp\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\tmp\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe"C:\Users\Admin\AppData\Local\Temp\tmp\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe"3⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\25aeffc1-eb6f-4f51-9f76-2ddaaaeb65f2_1007.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE18⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE20⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE22⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE24⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE26⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE28⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE30⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE32⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE34⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE36⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE38⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE40⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE42⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE44⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE46⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE48⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE50⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE52⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE54⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE56⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE58⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"59⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE60⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"61⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE62⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"63⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE64⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"65⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE66⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"67⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE68⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"69⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE70⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"71⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE72⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"73⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE74⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"75⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE76⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"77⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE78⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"79⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE80⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"81⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE82⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"83⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE84⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"85⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE86⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"87⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE88⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"89⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE90⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"91⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE92⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"93⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE94⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"95⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE96⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"97⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE98⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"99⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE100⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"101⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE102⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"103⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE104⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"105⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE106⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"107⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE108⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"109⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE110⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"111⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE112⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"113⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE114⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"115⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE116⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"117⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE118⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"119⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE120⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"121⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE122⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"123⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE124⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"125⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE126⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"127⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE128⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"129⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE130⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"131⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE132⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"133⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE134⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"135⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE136⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"137⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE138⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"139⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE140⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"141⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE142⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"143⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE144⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"145⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE146⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"147⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE148⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"149⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE150⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"151⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE152⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"153⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE154⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"155⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE156⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"157⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE158⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"159⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE160⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"161⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE162⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"163⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE164⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"165⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE166⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"167⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE168⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"169⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE170⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"171⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE172⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"173⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE174⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"175⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE176⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"177⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE178⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"179⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE180⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"181⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE182⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"183⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE184⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"185⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE186⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"187⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE188⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"189⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE190⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"191⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE192⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"193⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE194⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"195⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE196⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"197⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE198⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"199⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE200⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"201⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE202⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"203⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE204⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"205⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE206⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"207⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE208⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"209⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE210⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"211⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE212⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"213⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE214⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"215⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE216⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"217⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE218⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"219⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE220⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"221⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE222⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"223⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE224⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"225⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE226⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"227⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE228⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"229⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE230⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"231⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE232⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"233⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE234⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"235⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE236⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"237⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE238⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"239⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE240⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25AEFF~1.EXE"241⤵