Analysis
-
max time kernel
129s -
max time network
142s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-12-2021 05:06
Static task
static1
Behavioral task
behavioral1
Sample
tmp/1f732dad-540b-40f2-8e96-ece256af6051_1006.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
tmp/1f732dad-540b-40f2-8e96-ece256af6051_1006.exe
Resource
win10-en-20211208
General
-
Target
tmp/1f732dad-540b-40f2-8e96-ece256af6051_1006.exe
-
Size
3.6MB
-
MD5
8900fe14a0b6f8bce07e8544753a5489
-
SHA1
03735c613ea906da4e0a57390fc968b17268ded1
-
SHA256
5d7d8c5bf6c22376174fd83c86ba78d024a4d30ca0ad2657d65daca35ba3ba6e
-
SHA512
3bdc8d0fcb8f3536b988fb7a7ca9fc60ecf7a6beaf6baa5f9909656ca9f9012a70854af0568e2ae3e29893bc6b81ec6e089eb7cda11206245779ec8fbfa90833
Malware Config
Signatures
-
Detect Neshta Payload 33 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\tmp\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta C:\Users\Admin\AppData\Local\Temp\tmp\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE family_neshta C:\odt\OFFICE~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
1f732dad-540b-40f2-8e96-ece256af6051_1006.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
svchost.exe1f732dad-540b-40f2-8e96-ece256af6051_1006.exesvchost.exe1f732dad-540b-40f2-8e96-ece256af6051_1006.exesvchost.exe1f732dad-540b-40f2-8e96-ece256af6051_1006.exesvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.comsvchost.comsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXE1F732D~1.EXEsvchost.comsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXE1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.comsvchost.comsvchost.com1F732D~1.EXEpid process 776 svchost.exe 3532 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe 4008 svchost.exe 1304 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe 368 svchost.exe 1148 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe 2008 svchost.com 2900 1F732D~1.EXE 3460 svchost.com 3924 1F732D~1.EXE 888 svchost.com 3424 1F732D~1.EXE 1188 svchost.com 2816 svchost.com 2044 svchost.com 400 1F732D~1.EXE 2564 svchost.com 1072 1F732D~1.EXE 352 svchost.com 2428 1F732D~1.EXE 2536 svchost.com 1396 1F732D~1.EXE 2032 svchost.com 1804 1F732D~1.EXE 2208 svchost.com 3000 1F732D~1.EXE 3728 svchost.com 2760 1F732D~1.EXE 2636 svchost.com 3656 1F732D~1.EXE 2880 svchost.com 880 1F732D~1.EXE 2832 svchost.com 1692 1F732D~1.EXE 2120 svchost.com 3476 1F732D~1.EXE 1144 1F732D~1.EXE 1028 svchost.com 2312 svchost.com 808 1F732D~1.EXE 2640 svchost.com 3928 1F732D~1.EXE 1064 svchost.com 3924 1F732D~1.EXE 1856 svchost.com 3136 1F732D~1.EXE 676 svchost.com 1844 1F732D~1.EXE 2816 svchost.com 2544 1F732D~1.EXE 1700 svchost.com 2556 1F732D~1.EXE 972 svchost.com 1400 1F732D~1.EXE 3648 svchost.com 1344 1F732D~1.EXE 1388 svchost.com 1444 1F732D~1.EXE 2184 svchost.com 2212 1F732D~1.EXE 2096 svchost.com 3060 svchost.com 3560 svchost.com 3012 1F732D~1.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
1f732dad-540b-40f2-8e96-ece256af6051_1006.exe1f732dad-540b-40f2-8e96-ece256af6051_1006.exesvchost.exedescription ioc process File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe svchost.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe svchost.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe svchost.exe File opened for modification C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe svchost.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe svchost.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe svchost.exe -
Drops file in Windows directory 64 IoCs
Processes:
1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.comsvchost.comsvchost.com1F732D~1.EXE1F732D~1.EXEsvchost.com1F732D~1.EXE1F732D~1.EXE1F732D~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com1F732D~1.EXE1F732D~1.EXEsvchost.comsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXE1F732D~1.EXE1F732D~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXE1F732D~1.EXE1F732D~1.EXE1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.comsvchost.com1F732D~1.EXE1F732D~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com1F732D~1.EXEdescription ioc process File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com 1F732D~1.EXE File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 1F732D~1.EXE File opened for modification C:\Windows\svchost.com 1F732D~1.EXE File opened for modification C:\Windows\svchost.com 1F732D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com 1F732D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 1F732D~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 1F732D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 1F732D~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 1F732D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 1F732D~1.EXE File opened for modification C:\Windows\svchost.com 1F732D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 1F732D~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
Processes:
1F732D~1.EXE1F732D~1.EXE1F732D~1.EXE1F732D~1.EXEsvchost.com1F732D~1.EXE1F732D~1.EXE1F732D~1.EXE1F732D~1.EXE1F732D~1.EXE1F732D~1.EXE1F732D~1.EXE1F732D~1.EXE1F732D~1.EXE1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXE1F732D~1.EXE1F732D~1.EXE1F732D~1.EXE1F732D~1.EXE1F732D~1.EXE1F732D~1.EXE1F732D~1.EXEwmiprvse.exe1F732D~1.EXEsvchost.comsvchost.com1F732D~1.EXE1F732D~1.EXE1F732D~1.EXE1F732D~1.EXE1F732D~1.EXE1F732D~1.EXE1F732D~1.EXE1F732D~1.EXE1F732D~1.EXE1F732D~1.EXE1F732D~1.EXE1F732D~1.EXE1F732D~1.EXEsvchost.com1F732D~1.EXE1F732D~1.EXE1F732D~1.EXE1F732D~1.EXEsvchost.comsvchost.com1F732D~1.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings svchost.com Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings svchost.com Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings svchost.com Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings wmiprvse.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings svchost.com Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings svchost.com Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings svchost.com Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings svchost.com Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings svchost.com Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings 1F732D~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1f732dad-540b-40f2-8e96-ece256af6051_1006.exesvchost.exe1f732dad-540b-40f2-8e96-ece256af6051_1006.exe1f732dad-540b-40f2-8e96-ece256af6051_1006.exesvchost.exe1f732dad-540b-40f2-8e96-ece256af6051_1006.exesvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.comsvchost.comsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEsvchost.com1F732D~1.EXEdescription pid process target process PID 3364 wrote to memory of 776 3364 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe svchost.exe PID 3364 wrote to memory of 776 3364 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe svchost.exe PID 3364 wrote to memory of 776 3364 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe svchost.exe PID 776 wrote to memory of 3532 776 svchost.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe PID 776 wrote to memory of 3532 776 svchost.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe PID 776 wrote to memory of 3532 776 svchost.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe PID 3532 wrote to memory of 1304 3532 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe PID 3532 wrote to memory of 1304 3532 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe PID 3532 wrote to memory of 1304 3532 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe PID 1304 wrote to memory of 368 1304 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe svchost.exe PID 1304 wrote to memory of 368 1304 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe svchost.exe PID 1304 wrote to memory of 368 1304 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe svchost.exe PID 368 wrote to memory of 1148 368 svchost.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe PID 368 wrote to memory of 1148 368 svchost.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe PID 368 wrote to memory of 1148 368 svchost.exe 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe PID 1148 wrote to memory of 2008 1148 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe svchost.com PID 1148 wrote to memory of 2008 1148 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe svchost.com PID 1148 wrote to memory of 2008 1148 1f732dad-540b-40f2-8e96-ece256af6051_1006.exe svchost.com PID 2008 wrote to memory of 2900 2008 svchost.com 1F732D~1.EXE PID 2008 wrote to memory of 2900 2008 svchost.com 1F732D~1.EXE PID 2008 wrote to memory of 2900 2008 svchost.com 1F732D~1.EXE PID 2900 wrote to memory of 3460 2900 1F732D~1.EXE svchost.com PID 2900 wrote to memory of 3460 2900 1F732D~1.EXE svchost.com PID 2900 wrote to memory of 3460 2900 1F732D~1.EXE svchost.com PID 3460 wrote to memory of 3924 3460 svchost.com 1F732D~1.EXE PID 3460 wrote to memory of 3924 3460 svchost.com 1F732D~1.EXE PID 3460 wrote to memory of 3924 3460 svchost.com 1F732D~1.EXE PID 3924 wrote to memory of 888 3924 1F732D~1.EXE svchost.com PID 3924 wrote to memory of 888 3924 1F732D~1.EXE svchost.com PID 3924 wrote to memory of 888 3924 1F732D~1.EXE svchost.com PID 888 wrote to memory of 3424 888 svchost.com 1F732D~1.EXE PID 888 wrote to memory of 3424 888 svchost.com 1F732D~1.EXE PID 888 wrote to memory of 3424 888 svchost.com 1F732D~1.EXE PID 3424 wrote to memory of 1188 3424 1F732D~1.EXE svchost.com PID 3424 wrote to memory of 1188 3424 1F732D~1.EXE svchost.com PID 3424 wrote to memory of 1188 3424 1F732D~1.EXE svchost.com PID 1188 wrote to memory of 2816 1188 svchost.com svchost.com PID 1188 wrote to memory of 2816 1188 svchost.com svchost.com PID 1188 wrote to memory of 2816 1188 svchost.com svchost.com PID 2816 wrote to memory of 2044 2816 svchost.com svchost.com PID 2816 wrote to memory of 2044 2816 svchost.com svchost.com PID 2816 wrote to memory of 2044 2816 svchost.com svchost.com PID 2044 wrote to memory of 400 2044 svchost.com 1F732D~1.EXE PID 2044 wrote to memory of 400 2044 svchost.com 1F732D~1.EXE PID 2044 wrote to memory of 400 2044 svchost.com 1F732D~1.EXE PID 400 wrote to memory of 2564 400 1F732D~1.EXE svchost.com PID 400 wrote to memory of 2564 400 1F732D~1.EXE svchost.com PID 400 wrote to memory of 2564 400 1F732D~1.EXE svchost.com PID 2564 wrote to memory of 1072 2564 svchost.com 1F732D~1.EXE PID 2564 wrote to memory of 1072 2564 svchost.com 1F732D~1.EXE PID 2564 wrote to memory of 1072 2564 svchost.com 1F732D~1.EXE PID 1072 wrote to memory of 352 1072 1F732D~1.EXE svchost.com PID 1072 wrote to memory of 352 1072 1F732D~1.EXE svchost.com PID 1072 wrote to memory of 352 1072 1F732D~1.EXE svchost.com PID 352 wrote to memory of 2428 352 svchost.com 1F732D~1.EXE PID 352 wrote to memory of 2428 352 svchost.com 1F732D~1.EXE PID 352 wrote to memory of 2428 352 svchost.com 1F732D~1.EXE PID 2428 wrote to memory of 2536 2428 1F732D~1.EXE svchost.com PID 2428 wrote to memory of 2536 2428 1F732D~1.EXE svchost.com PID 2428 wrote to memory of 2536 2428 1F732D~1.EXE svchost.com PID 2536 wrote to memory of 1396 2536 svchost.com 1F732D~1.EXE PID 2536 wrote to memory of 1396 2536 svchost.com 1F732D~1.EXE PID 2536 wrote to memory of 1396 2536 svchost.com 1F732D~1.EXE PID 1396 wrote to memory of 2032 1396 1F732D~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe"C:\Users\Admin\AppData\Local\Temp\tmp\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\tmp\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe"C:\Users\Admin\AppData\Local\Temp\tmp\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe"3⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\1f732dad-540b-40f2-8e96-ece256af6051_1006.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE14⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE20⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"23⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE24⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"25⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE26⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"27⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE28⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"29⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE30⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"31⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE32⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"33⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE34⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"35⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE36⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"37⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE38⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"39⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE40⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"41⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE42⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"43⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE44⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"45⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE46⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"47⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE48⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE50⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"51⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE52⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"53⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE54⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"55⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE56⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"57⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE58⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"59⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE60⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"61⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE62⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"63⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE64⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"65⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE66⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"67⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE68⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"69⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE70⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"71⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE72⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"73⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE74⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"75⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE76⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"77⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE78⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"79⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE80⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"81⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE82⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"83⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE84⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"85⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE86⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"87⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE88⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"89⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE90⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"91⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE92⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"93⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE94⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"95⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE96⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"97⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE98⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"99⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE100⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"101⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE102⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"103⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE104⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"105⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE106⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"107⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE108⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"109⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE110⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"111⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE112⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"113⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE114⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"115⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE116⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"117⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE118⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"119⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE120⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"121⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE122⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"123⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE124⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"125⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE126⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"127⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE128⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"129⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE130⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"131⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE132⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"133⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE134⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"135⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE136⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"137⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE138⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"139⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE140⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"141⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE142⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"143⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE144⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"145⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE146⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"147⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE148⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"149⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE150⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"151⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE152⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"153⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE154⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"155⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE156⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"157⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE158⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"159⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE160⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"161⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE162⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"163⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE164⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"165⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE166⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"167⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE168⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"169⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE170⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"171⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE172⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"173⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE174⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"175⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE176⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"177⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE178⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"179⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE180⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"181⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE182⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"183⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE184⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"185⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE186⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"187⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE188⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"189⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE190⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"191⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE192⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"193⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE194⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"195⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE196⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"197⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE198⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"199⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE200⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"201⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE202⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"203⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE204⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"205⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE206⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"207⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE208⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"209⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE210⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"211⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE212⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"213⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE214⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"215⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE216⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"217⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE218⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"219⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE220⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"221⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE222⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"223⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE224⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"225⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE226⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"227⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE228⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"229⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE230⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"231⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE232⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"233⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE234⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"235⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE236⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"237⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE238⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"239⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE240⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1F732D~1.EXE"241⤵