Analysis
-
max time kernel
135s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-12-2021 05:03
Static task
static1
Behavioral task
behavioral1
Sample
tmp/b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
tmp/b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe
Resource
win10-en-20211208
General
-
Target
tmp/b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe
-
Size
3.6MB
-
MD5
0df509291dbe0de01efd4e59b5c3b2dc
-
SHA1
06e97544849ce889a83e3c4f5bc74c99971d668d
-
SHA256
bae433ef175b58fde659d4c84a8bd8d6625f75b3d7b56b4771c6dbb377d03efa
-
SHA512
3e9383ee1ec55c980c1570f89ff3be76d62b2714553a04bd5deb2d3e373bb6e5afbaf5cd8a64dd3635e49d281af39a2b081cac1a3ea653e92ba03c5d668c40b5
Malware Config
Signatures
-
Detect Neshta Payload 39 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\tmp\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta \Users\Admin\AppData\Local\Temp\tmp\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta C:\Users\Admin\AppData\Local\Temp\tmp\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta C:\Users\Admin\AppData\Local\Temp\tmp\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta C:\Windows\svchost.com family_neshta C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
svchost.exeb3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exesvchost.exeb3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exesvchost.exeb3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exesvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEpid process 1876 svchost.exe 1096 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe 1164 svchost.exe 580 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe 1884 svchost.exe 704 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe 816 svchost.com 1760 B3FA4A~1.EXE 1200 svchost.com 1800 B3FA4A~1.EXE 980 svchost.com 1704 B3FA4A~1.EXE 264 svchost.com 1736 B3FA4A~1.EXE 968 svchost.com 1776 B3FA4A~1.EXE 1092 svchost.com 1960 B3FA4A~1.EXE 324 svchost.com 2040 B3FA4A~1.EXE 904 svchost.com 1564 B3FA4A~1.EXE 748 svchost.com 1920 B3FA4A~1.EXE 824 svchost.com 1664 B3FA4A~1.EXE 1460 svchost.com 1308 B3FA4A~1.EXE 1028 svchost.com 1504 B3FA4A~1.EXE 460 svchost.com 980 B3FA4A~1.EXE 1912 svchost.com 752 B3FA4A~1.EXE 1688 svchost.com 1380 B3FA4A~1.EXE 1752 svchost.com 1748 B3FA4A~1.EXE 1604 svchost.com 1976 B3FA4A~1.EXE 1100 svchost.com 1960 B3FA4A~1.EXE 488 svchost.com 1224 B3FA4A~1.EXE 1184 svchost.com 1908 B3FA4A~1.EXE 1368 svchost.com 1336 B3FA4A~1.EXE 440 svchost.com 1920 B3FA4A~1.EXE 1248 svchost.com 1628 B3FA4A~1.EXE 996 svchost.com 1756 B3FA4A~1.EXE 1568 svchost.com 820 B3FA4A~1.EXE 1728 svchost.com 1444 B3FA4A~1.EXE 752 svchost.com 924 B3FA4A~1.EXE 1896 svchost.com 1544 B3FA4A~1.EXE 1744 svchost.com 1612 B3FA4A~1.EXE -
Loads dropped DLL 64 IoCs
Processes:
svchost.exeb3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exesvchost.exeb3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.compid process 1876 svchost.exe 1876 svchost.exe 1096 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe 1096 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe 1096 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe 1096 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe 1884 svchost.exe 1884 svchost.exe 704 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe 704 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe 816 svchost.com 816 svchost.com 1200 svchost.com 1200 svchost.com 980 svchost.com 980 svchost.com 264 svchost.com 264 svchost.com 968 svchost.com 968 svchost.com 1092 svchost.com 1092 svchost.com 324 svchost.com 324 svchost.com 904 svchost.com 904 svchost.com 748 svchost.com 748 svchost.com 824 svchost.com 824 svchost.com 1460 svchost.com 1460 svchost.com 1028 svchost.com 1028 svchost.com 460 svchost.com 460 svchost.com 1912 svchost.com 1912 svchost.com 1688 svchost.com 1688 svchost.com 704 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe 1096 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe 1752 svchost.com 1752 svchost.com 1604 svchost.com 1604 svchost.com 1100 svchost.com 1100 svchost.com 488 svchost.com 488 svchost.com 1184 svchost.com 1184 svchost.com 1368 svchost.com 1368 svchost.com 440 svchost.com 440 svchost.com 1248 svchost.com 1248 svchost.com 996 svchost.com 996 svchost.com 1568 svchost.com 1568 svchost.com 1728 svchost.com 1728 svchost.com -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exeb3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exesvchost.exedescription ioc process File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe -
Drops file in Windows directory 64 IoCs
Processes:
B3FA4A~1.EXEB3FA4A~1.EXEsvchost.comsvchost.comB3FA4A~1.EXEB3FA4A~1.EXEB3FA4A~1.EXEB3FA4A~1.EXEB3FA4A~1.EXEsvchost.comsvchost.comB3FA4A~1.EXEB3FA4A~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEB3FA4A~1.EXEB3FA4A~1.EXEsvchost.comsvchost.comsvchost.comB3FA4A~1.EXEB3FA4A~1.EXEB3FA4A~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comB3FA4A~1.EXEB3FA4A~1.EXEdescription ioc process File opened for modification C:\Windows\svchost.com B3FA4A~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com B3FA4A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys B3FA4A~1.EXE File opened for modification C:\Windows\directx.sys B3FA4A~1.EXE File opened for modification C:\Windows\svchost.com B3FA4A~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys B3FA4A~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys B3FA4A~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com B3FA4A~1.EXE File opened for modification C:\Windows\directx.sys B3FA4A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com B3FA4A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com B3FA4A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com B3FA4A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com B3FA4A~1.EXE File opened for modification C:\Windows\svchost.com B3FA4A~1.EXE File opened for modification C:\Windows\svchost.com B3FA4A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com B3FA4A~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com B3FA4A~1.EXE File opened for modification C:\Windows\svchost.com B3FA4A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com B3FA4A~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com B3FA4A~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys B3FA4A~1.EXE File opened for modification C:\Windows\svchost.com B3FA4A~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exesvchost.exeb3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exeb3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exesvchost.exeb3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exesvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEsvchost.comB3FA4A~1.EXEdescription pid process target process PID 1900 wrote to memory of 1876 1900 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe svchost.exe PID 1900 wrote to memory of 1876 1900 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe svchost.exe PID 1900 wrote to memory of 1876 1900 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe svchost.exe PID 1900 wrote to memory of 1876 1900 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe svchost.exe PID 1876 wrote to memory of 1096 1876 svchost.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe PID 1876 wrote to memory of 1096 1876 svchost.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe PID 1876 wrote to memory of 1096 1876 svchost.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe PID 1876 wrote to memory of 1096 1876 svchost.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe PID 1096 wrote to memory of 580 1096 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe PID 1096 wrote to memory of 580 1096 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe PID 1096 wrote to memory of 580 1096 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe PID 1096 wrote to memory of 580 1096 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe PID 580 wrote to memory of 1884 580 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe svchost.exe PID 580 wrote to memory of 1884 580 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe svchost.exe PID 580 wrote to memory of 1884 580 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe svchost.exe PID 580 wrote to memory of 1884 580 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe svchost.exe PID 1884 wrote to memory of 704 1884 svchost.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe PID 1884 wrote to memory of 704 1884 svchost.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe PID 1884 wrote to memory of 704 1884 svchost.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe PID 1884 wrote to memory of 704 1884 svchost.exe b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe PID 704 wrote to memory of 816 704 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe svchost.com PID 704 wrote to memory of 816 704 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe svchost.com PID 704 wrote to memory of 816 704 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe svchost.com PID 704 wrote to memory of 816 704 b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe svchost.com PID 816 wrote to memory of 1760 816 svchost.com B3FA4A~1.EXE PID 816 wrote to memory of 1760 816 svchost.com B3FA4A~1.EXE PID 816 wrote to memory of 1760 816 svchost.com B3FA4A~1.EXE PID 816 wrote to memory of 1760 816 svchost.com B3FA4A~1.EXE PID 1760 wrote to memory of 1200 1760 B3FA4A~1.EXE svchost.com PID 1760 wrote to memory of 1200 1760 B3FA4A~1.EXE svchost.com PID 1760 wrote to memory of 1200 1760 B3FA4A~1.EXE svchost.com PID 1760 wrote to memory of 1200 1760 B3FA4A~1.EXE svchost.com PID 1200 wrote to memory of 1800 1200 svchost.com B3FA4A~1.EXE PID 1200 wrote to memory of 1800 1200 svchost.com B3FA4A~1.EXE PID 1200 wrote to memory of 1800 1200 svchost.com B3FA4A~1.EXE PID 1200 wrote to memory of 1800 1200 svchost.com B3FA4A~1.EXE PID 1800 wrote to memory of 980 1800 B3FA4A~1.EXE svchost.com PID 1800 wrote to memory of 980 1800 B3FA4A~1.EXE svchost.com PID 1800 wrote to memory of 980 1800 B3FA4A~1.EXE svchost.com PID 1800 wrote to memory of 980 1800 B3FA4A~1.EXE svchost.com PID 980 wrote to memory of 1704 980 svchost.com B3FA4A~1.EXE PID 980 wrote to memory of 1704 980 svchost.com B3FA4A~1.EXE PID 980 wrote to memory of 1704 980 svchost.com B3FA4A~1.EXE PID 980 wrote to memory of 1704 980 svchost.com B3FA4A~1.EXE PID 1704 wrote to memory of 264 1704 B3FA4A~1.EXE svchost.com PID 1704 wrote to memory of 264 1704 B3FA4A~1.EXE svchost.com PID 1704 wrote to memory of 264 1704 B3FA4A~1.EXE svchost.com PID 1704 wrote to memory of 264 1704 B3FA4A~1.EXE svchost.com PID 264 wrote to memory of 1736 264 svchost.com B3FA4A~1.EXE PID 264 wrote to memory of 1736 264 svchost.com B3FA4A~1.EXE PID 264 wrote to memory of 1736 264 svchost.com B3FA4A~1.EXE PID 264 wrote to memory of 1736 264 svchost.com B3FA4A~1.EXE PID 1736 wrote to memory of 968 1736 B3FA4A~1.EXE svchost.com PID 1736 wrote to memory of 968 1736 B3FA4A~1.EXE svchost.com PID 1736 wrote to memory of 968 1736 B3FA4A~1.EXE svchost.com PID 1736 wrote to memory of 968 1736 B3FA4A~1.EXE svchost.com PID 968 wrote to memory of 1776 968 svchost.com B3FA4A~1.EXE PID 968 wrote to memory of 1776 968 svchost.com B3FA4A~1.EXE PID 968 wrote to memory of 1776 968 svchost.com B3FA4A~1.EXE PID 968 wrote to memory of 1776 968 svchost.com B3FA4A~1.EXE PID 1776 wrote to memory of 1092 1776 B3FA4A~1.EXE svchost.com PID 1776 wrote to memory of 1092 1776 B3FA4A~1.EXE svchost.com PID 1776 wrote to memory of 1092 1776 B3FA4A~1.EXE svchost.com PID 1776 wrote to memory of 1092 1776 B3FA4A~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe"C:\Users\Admin\AppData\Local\Temp\tmp\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\tmp\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe"C:\Users\Admin\AppData\Local\Temp\tmp\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe"3⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\b3fa4a1b-268f-49b2-9a04-47f6550e1a9a_1009.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE18⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE20⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE22⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE24⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE26⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE28⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE30⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE32⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE34⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE36⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE38⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE40⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE42⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE44⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE46⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE48⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE50⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE52⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE54⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE56⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE58⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"59⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE60⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"61⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE62⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"63⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE64⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"65⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE66⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"67⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE68⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"69⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE70⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"71⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE72⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"73⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE74⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"75⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE76⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"77⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE78⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"79⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE80⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"81⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE82⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"83⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE84⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"85⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE86⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"87⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE88⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"89⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE90⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"91⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE92⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"93⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE94⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"95⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE96⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"97⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE98⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"99⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE100⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"101⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE102⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"103⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE104⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"105⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE106⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"107⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE108⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"109⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE110⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"111⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE112⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"113⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE114⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"115⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE116⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"117⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE118⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"119⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE120⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"121⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE122⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"123⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE124⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"125⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE126⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"127⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE128⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"129⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE130⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"131⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE132⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"133⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE134⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"135⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE136⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"137⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE138⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"139⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE140⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"141⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE142⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"143⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE144⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"145⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE146⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"147⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE148⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"149⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE150⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"151⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE152⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"153⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE154⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"155⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE156⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"157⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE158⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"159⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE160⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"161⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE162⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"163⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE164⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"165⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE166⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"167⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE168⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"169⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE170⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"171⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE172⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"173⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE174⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"175⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE176⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"177⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE178⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"179⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE180⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"181⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE182⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"183⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE184⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"185⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE186⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"187⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE188⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"189⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE190⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"191⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE192⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"193⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE194⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"195⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE196⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"197⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE198⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"199⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE200⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"201⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE202⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"203⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE204⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"205⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE206⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"207⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE208⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"209⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE210⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"211⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE212⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"213⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE214⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"215⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE216⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"217⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE218⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"219⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE220⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"221⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE222⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"223⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE224⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"225⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE226⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"227⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE228⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"229⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE230⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"231⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE232⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"233⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE234⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"235⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE236⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"237⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE238⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"239⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE240⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B3FA4A~1.EXE"241⤵