Analysis
-
max time kernel
134s -
max time network
117s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-12-2021 05:06
Static task
static1
Behavioral task
behavioral1
Sample
tmp/1f732dad-540b-40f2-8e96-ece256af6051_1006.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
tmp/1f732dad-540b-40f2-8e96-ece256af6051_1006.exe
Resource
win10-en-20211208
General
-
Target
tmp/1f732dad-540b-40f2-8e96-ece256af6051_1006.exe
-
Size
3.6MB
-
MD5
8900fe14a0b6f8bce07e8544753a5489
-
SHA1
03735c613ea906da4e0a57390fc968b17268ded1
-
SHA256
5d7d8c5bf6c22376174fd83c86ba78d024a4d30ca0ad2657d65daca35ba3ba6e
-
SHA512
3bdc8d0fcb8f3536b988fb7a7ca9fc60ecf7a6beaf6baa5f9909656ca9f9012a70854af0568e2ae3e29893bc6b81ec6e089eb7cda11206245779ec8fbfa90833
Malware Config
Signatures
-
Detect Neshta Payload 39 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\tmp\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta \Users\Admin\AppData\Local\Temp\tmp\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta C:\Users\Admin\AppData\Local\Temp\tmp\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta C:\Users\Admin\AppData\Local\Temp\tmp\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
1f732dad-540b-40f2-8e96-ece256af6051_1006.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
svchost.exe1f732dad-540b-40f2-8e96-ece256af6051_1006.exesvchost.exe1f732dad-540b-40f2-8e96-ece256af6051_1006.exesvchost.exe1f732dad-540b-40f2-8e96-ece256af6051_1006.exesvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEpid process 1472 svchost.exe 1896 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe 764 svchost.exe 288 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe 1356 svchost.exe 1812 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe 1148 svchost.com 1488 1F732D~1.EXE 1132 svchost.com 1712 1F732D~1.EXE 1300 svchost.com 1728 1F732D~1.EXE 1824 svchost.com 388 1F732D~1.EXE 1316 svchost.com 1532 1F732D~1.EXE 1608 svchost.com 1260 1F732D~1.EXE 1472 svchost.com 1120 1F732D~1.EXE 396 svchost.com 1052 1F732D~1.EXE 968 svchost.com 1544 1F732D~1.EXE 1180 svchost.com 1076 1F732D~1.EXE 988 svchost.com 1132 1F732D~1.EXE 1772 svchost.com 1908 1F732D~1.EXE 1124 svchost.com 2004 1F732D~1.EXE 680 svchost.com 1536 1F732D~1.EXE 1776 svchost.com 1928 1F732D~1.EXE 1532 svchost.com 1152 1F732D~1.EXE 288 svchost.com 636 1F732D~1.EXE 1472 svchost.com 524 1F732D~1.EXE 952 svchost.com 1492 1F732D~1.EXE 848 svchost.com 1756 1F732D~1.EXE 1116 svchost.com 1544 1F732D~1.EXE 1548 svchost.com 620 1F732D~1.EXE 1420 svchost.com 1496 1F732D~1.EXE 1364 svchost.com 976 1F732D~1.EXE 1824 svchost.com 892 1F732D~1.EXE 912 svchost.com 1292 1F732D~1.EXE 1588 svchost.com 1776 1F732D~1.EXE 1608 svchost.com 1532 1F732D~1.EXE 1688 svchost.com 1224 1F732D~1.EXE -
Loads dropped DLL 64 IoCs
Processes:
svchost.exe1f732dad-540b-40f2-8e96-ece256af6051_1006.exesvchost.exe1f732dad-540b-40f2-8e96-ece256af6051_1006.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.compid process 1472 svchost.exe 1472 svchost.exe 1896 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe 1896 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe 1896 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe 1356 svchost.exe 1356 svchost.exe 1812 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe 1812 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe 1148 svchost.com 1148 svchost.com 1132 svchost.com 1132 svchost.com 1300 svchost.com 1300 svchost.com 1824 svchost.com 1824 svchost.com 1316 svchost.com 1316 svchost.com 1608 svchost.com 1608 svchost.com 1472 svchost.com 1472 svchost.com 1812 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe 1896 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe 396 svchost.com 396 svchost.com 968 svchost.com 968 svchost.com 1180 svchost.com 1180 svchost.com 988 svchost.com 988 svchost.com 1772 svchost.com 1772 svchost.com 1124 svchost.com 1124 svchost.com 680 svchost.com 680 svchost.com 1776 svchost.com 1776 svchost.com 1532 svchost.com 1532 svchost.com 288 svchost.com 288 svchost.com 1472 svchost.com 1472 svchost.com 952 svchost.com 952 svchost.com 848 svchost.com 848 svchost.com 1116 svchost.com 1116 svchost.com 1548 svchost.com 1548 svchost.com 1420 svchost.com 1420 svchost.com 1364 svchost.com 1364 svchost.com 1824 svchost.com 1824 svchost.com 912 svchost.com 912 svchost.com 1588 svchost.com -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
1f732dad-540b-40f2-8e96-ece256af6051_1006.exe1f732dad-540b-40f2-8e96-ece256af6051_1006.exedescription ioc process File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe -
Drops file in Windows directory 64 IoCs
Processes:
svchost.comsvchost.com1F732D~1.EXEsvchost.comsvchost.comsvchost.comsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXE1F732D~1.EXEsvchost.comsvchost.com1F732D~1.EXEsvchost.comsvchost.com1F732D~1.EXE1F732D~1.EXE1F732D~1.EXEsvchost.comsvchost.comsvchost.com1F732D~1.EXEsvchost.comsvchost.com1F732D~1.EXEsvchost.comsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXE1F732D~1.EXEsvchost.comsvchost.comsvchost.com1F732D~1.EXE1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.comsvchost.comsvchost.comsvchost.com1F732D~1.EXE1F732D~1.EXEsvchost.comsvchost.comsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.comsvchost.comsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.comdescription ioc process File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 1F732D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 1F732D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 1F732D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\svchost.com 1F732D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 1F732D~1.EXE File opened for modification C:\Windows\svchost.com 1F732D~1.EXE File opened for modification C:\Windows\svchost.com 1F732D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 1F732D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\svchost.com 1F732D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\svchost.com 1F732D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 1F732D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
1f732dad-540b-40f2-8e96-ece256af6051_1006.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1f732dad-540b-40f2-8e96-ece256af6051_1006.exesvchost.exe1f732dad-540b-40f2-8e96-ece256af6051_1006.exe1f732dad-540b-40f2-8e96-ece256af6051_1006.exesvchost.exe1f732dad-540b-40f2-8e96-ece256af6051_1006.exesvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEdescription pid process target process PID 1260 wrote to memory of 1472 1260 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe svchost.exe PID 1260 wrote to memory of 1472 1260 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe svchost.exe PID 1260 wrote to memory of 1472 1260 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe svchost.exe PID 1260 wrote to memory of 1472 1260 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe svchost.exe PID 1472 wrote to memory of 1896 1472 svchost.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe PID 1472 wrote to memory of 1896 1472 svchost.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe PID 1472 wrote to memory of 1896 1472 svchost.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe PID 1472 wrote to memory of 1896 1472 svchost.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe PID 1896 wrote to memory of 288 1896 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe PID 1896 wrote to memory of 288 1896 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe PID 1896 wrote to memory of 288 1896 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe PID 1896 wrote to memory of 288 1896 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe PID 288 wrote to memory of 1356 288 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe svchost.exe PID 288 wrote to memory of 1356 288 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe svchost.exe PID 288 wrote to memory of 1356 288 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe svchost.exe PID 288 wrote to memory of 1356 288 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe svchost.exe PID 1356 wrote to memory of 1812 1356 svchost.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe PID 1356 wrote to memory of 1812 1356 svchost.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe PID 1356 wrote to memory of 1812 1356 svchost.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe PID 1356 wrote to memory of 1812 1356 svchost.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe PID 1812 wrote to memory of 1148 1812 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe svchost.com PID 1812 wrote to memory of 1148 1812 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe svchost.com PID 1812 wrote to memory of 1148 1812 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe svchost.com PID 1812 wrote to memory of 1148 1812 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe svchost.com PID 1148 wrote to memory of 1488 1148 svchost.com 1F732D~1.EXE PID 1148 wrote to memory of 1488 1148 svchost.com 1F732D~1.EXE PID 1148 wrote to memory of 1488 1148 svchost.com 1F732D~1.EXE PID 1148 wrote to memory of 1488 1148 svchost.com 1F732D~1.EXE PID 1488 wrote to memory of 1132 1488 1F732D~1.EXE svchost.com PID 1488 wrote to memory of 1132 1488 1F732D~1.EXE svchost.com PID 1488 wrote to memory of 1132 1488 1F732D~1.EXE svchost.com PID 1488 wrote to memory of 1132 1488 1F732D~1.EXE svchost.com PID 1132 wrote to memory of 1712 1132 svchost.com 1F732D~1.EXE PID 1132 wrote to memory of 1712 1132 svchost.com 1F732D~1.EXE PID 1132 wrote to memory of 1712 1132 svchost.com 1F732D~1.EXE PID 1132 wrote to memory of 1712 1132 svchost.com 1F732D~1.EXE PID 1712 wrote to memory of 1300 1712 1F732D~1.EXE svchost.com PID 1712 wrote to memory of 1300 1712 1F732D~1.EXE svchost.com PID 1712 wrote to memory of 1300 1712 1F732D~1.EXE svchost.com PID 1712 wrote to memory of 1300 1712 1F732D~1.EXE svchost.com PID 1300 wrote to memory of 1728 1300 svchost.com 1F732D~1.EXE PID 1300 wrote to memory of 1728 1300 svchost.com 1F732D~1.EXE PID 1300 wrote to memory of 1728 1300 svchost.com 1F732D~1.EXE PID 1300 wrote to memory of 1728 1300 svchost.com 1F732D~1.EXE PID 1728 wrote to memory of 1824 1728 1F732D~1.EXE svchost.com PID 1728 wrote to memory of 1824 1728 1F732D~1.EXE svchost.com PID 1728 wrote to memory of 1824 1728 1F732D~1.EXE svchost.com PID 1728 wrote to memory of 1824 1728 1F732D~1.EXE svchost.com PID 1824 wrote to memory of 388 1824 svchost.com 1F732D~1.EXE PID 1824 wrote to memory of 388 1824 svchost.com 1F732D~1.EXE PID 1824 wrote to memory of 388 1824 svchost.com 1F732D~1.EXE PID 1824 wrote to memory of 388 1824 svchost.com 1F732D~1.EXE PID 388 wrote to memory of 1316 388 1F732D~1.EXE svchost.com PID 388 wrote to memory of 1316 388 1F732D~1.EXE svchost.com PID 388 wrote to memory of 1316 388 1F732D~1.EXE svchost.com PID 388 wrote to memory of 1316 388 1F732D~1.EXE svchost.com PID 1316 wrote to memory of 1532 1316 svchost.com 1F732D~1.EXE PID 1316 wrote to memory of 1532 1316 svchost.com 1F732D~1.EXE PID 1316 wrote to memory of 1532 1316 svchost.com 1F732D~1.EXE PID 1316 wrote to memory of 1532 1316 svchost.com 1F732D~1.EXE PID 1532 wrote to memory of 1608 1532 1F732D~1.EXE svchost.com PID 1532 wrote to memory of 1608 1532 1F732D~1.EXE svchost.com PID 1532 wrote to memory of 1608 1532 1F732D~1.EXE svchost.com PID 1532 wrote to memory of 1608 1532 1F732D~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe"C:\Users\Admin\AppData\Local\Temp\tmp\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\tmp\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe"C:\Users\Admin\AppData\Local\Temp\tmp\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe"3⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE8⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE18⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE20⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE22⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE24⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE26⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE28⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE30⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE32⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE34⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE36⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE38⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE40⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE42⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE44⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE46⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE48⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE50⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE52⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE54⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE56⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE58⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE60⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"61⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE62⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"63⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE64⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"65⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE66⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"67⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE68⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"69⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE70⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"71⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE72⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"73⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE74⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"75⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE76⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"77⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE78⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"79⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE80⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"81⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE82⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"83⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE84⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"85⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE86⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"87⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE88⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"89⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE90⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"91⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE92⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"93⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE94⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"95⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE96⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"97⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE98⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"99⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE100⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"101⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE102⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"103⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE104⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"105⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE106⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"107⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE108⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"109⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE110⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"111⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE112⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"113⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE114⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"115⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE116⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"117⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE118⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"119⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE120⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"121⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE122⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"123⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE124⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"125⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE126⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"127⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE128⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"129⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE130⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"131⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE132⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"133⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE134⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"135⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE136⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"137⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE138⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"139⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE140⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"141⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE142⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"143⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE144⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"145⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE146⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"147⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE148⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"149⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE150⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"151⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE152⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"153⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE154⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"155⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE156⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"157⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE158⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"159⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE160⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"161⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE162⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"163⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE164⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"165⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE166⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"167⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE168⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"169⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE170⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"171⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE172⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"173⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE174⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"175⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE176⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"177⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE178⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"179⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE180⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"181⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE182⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"183⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE184⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"185⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE186⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"187⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE188⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"189⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE190⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"191⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE192⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"193⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE194⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"195⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE196⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"197⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE198⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"199⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE200⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"201⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE202⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"203⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE204⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"205⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE206⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"207⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE208⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"209⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE210⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"211⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE212⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"213⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE214⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"215⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE216⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"217⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE218⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"219⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE220⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"221⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE222⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"223⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE224⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"225⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE226⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"227⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE228⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"229⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE230⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"231⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE232⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"233⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE234⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"235⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE236⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"237⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE238⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"239⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE240⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"241⤵