Analysis
-
max time kernel
145s -
max time network
126s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-12-2021 05:06
Static task
static1
Behavioral task
behavioral1
Sample
tmp/a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
tmp/a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe
Resource
win10-en-20211208
General
-
Target
tmp/a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe
-
Size
2.7MB
-
MD5
b99e52186d2c0f482592184c034a5b42
-
SHA1
4b3148537c594400283cdbcbb01cad18887cd745
-
SHA256
3ae96468f8fd491e673fd862d5926da87b33cea066038910b29ed3d493f5e9f3
-
SHA512
e3df8ba7327e2cd0d0fe064ac2ff95b7ff2a34aa2cf39f2822973827bc06205b8fb2b1246bbce9393ffcfa3e8545634d10a6256feea20b8341a9be5be6d7bf34
Malware Config
Signatures
-
Detect Neshta Payload 39 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\tmp\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta \Users\Admin\AppData\Local\Temp\tmp\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta C:\Users\Admin\AppData\Local\Temp\tmp\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta C:\Users\Admin\AppData\Local\Temp\tmp\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta C:\Windows\svchost.com family_neshta C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
svchost.exea1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exesvchost.exea1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exesvchost.exea1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exesvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEpid process 1692 svchost.exe 1048 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe 760 svchost.exe 1740 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe 1760 svchost.exe 360 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe 1828 svchost.com 1836 A1662B~1.EXE 1556 svchost.com 1560 A1662B~1.EXE 1960 svchost.com 1728 A1662B~1.EXE 384 svchost.com 276 A1662B~1.EXE 924 svchost.com 1180 A1662B~1.EXE 1792 svchost.com 1672 A1662B~1.EXE 1524 svchost.com 1544 A1662B~1.EXE 1856 svchost.com 1108 A1662B~1.EXE 1520 svchost.com 1832 A1662B~1.EXE 1652 svchost.com 872 A1662B~1.EXE 1556 svchost.com 1700 A1662B~1.EXE 308 svchost.com 1512 A1662B~1.EXE 1704 svchost.com 1424 A1662B~1.EXE 892 svchost.com 1752 A1662B~1.EXE 1764 svchost.com 1180 A1662B~1.EXE 588 svchost.com 520 A1662B~1.EXE 1736 svchost.com 1760 A1662B~1.EXE 564 svchost.com 1544 A1662B~1.EXE 272 svchost.com 1600 A1662B~1.EXE 1804 svchost.com 796 A1662B~1.EXE 1368 svchost.com 1868 A1662B~1.EXE 1688 svchost.com 1004 A1662B~1.EXE 1724 svchost.com 844 A1662B~1.EXE 1512 svchost.com 1632 A1662B~1.EXE 1704 svchost.com 560 A1662B~1.EXE 1752 svchost.com 956 A1662B~1.EXE 1180 svchost.com 1792 A1662B~1.EXE 520 svchost.com 1680 A1662B~1.EXE 1760 svchost.com 1384 A1662B~1.EXE -
Loads dropped DLL 64 IoCs
Processes:
svchost.exea1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exesvchost.exea1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.compid process 1692 svchost.exe 1692 svchost.exe 1048 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe 1048 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe 1048 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe 1048 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe 1760 svchost.exe 1760 svchost.exe 360 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe 360 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe 1828 svchost.com 1828 svchost.com 1556 svchost.com 1556 svchost.com 1960 svchost.com 1960 svchost.com 384 svchost.com 384 svchost.com 924 svchost.com 924 svchost.com 1792 svchost.com 1792 svchost.com 1524 svchost.com 1524 svchost.com 1048 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe 1856 svchost.com 1856 svchost.com 1520 svchost.com 1520 svchost.com 1652 svchost.com 1652 svchost.com 1556 svchost.com 1556 svchost.com 308 svchost.com 308 svchost.com 1704 svchost.com 1704 svchost.com 892 svchost.com 892 svchost.com 1764 svchost.com 1764 svchost.com 588 svchost.com 588 svchost.com 1736 svchost.com 1736 svchost.com 564 svchost.com 564 svchost.com 272 svchost.com 272 svchost.com 1804 svchost.com 1804 svchost.com 1368 svchost.com 1368 svchost.com 1688 svchost.com 1688 svchost.com 1724 svchost.com 1724 svchost.com 1512 svchost.com 1512 svchost.com 1704 svchost.com 1704 svchost.com 1752 svchost.com 1752 svchost.com 1180 svchost.com -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
svchost.exea1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exea1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7zG.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE svchost.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe -
Drops file in Windows directory 64 IoCs
Processes:
A1662B~1.EXEsvchost.comsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEA1662B~1.EXEsvchost.comsvchost.comA1662B~1.EXEA1662B~1.EXEA1662B~1.EXEA1662B~1.EXEA1662B~1.EXEA1662B~1.EXEsvchost.comA1662B~1.EXEA1662B~1.EXEsvchost.comsvchost.comA1662B~1.EXEA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEA1662B~1.EXEsvchost.comsvchost.comA1662B~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comsvchost.comsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEA1662B~1.EXEA1662B~1.EXEA1662B~1.EXEsvchost.comA1662B~1.EXEA1662B~1.EXEsvchost.comA1662B~1.EXEA1662B~1.EXEA1662B~1.EXEA1662B~1.EXEsvchost.comsvchost.comA1662B~1.EXEsvchost.comdescription ioc process File opened for modification C:\Windows\directx.sys A1662B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com A1662B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys A1662B~1.EXE File opened for modification C:\Windows\directx.sys A1662B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys A1662B~1.EXE File opened for modification C:\Windows\directx.sys A1662B~1.EXE File opened for modification C:\Windows\directx.sys A1662B~1.EXE File opened for modification C:\Windows\svchost.com A1662B~1.EXE File opened for modification C:\Windows\svchost.com A1662B~1.EXE File opened for modification C:\Windows\directx.sys A1662B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys A1662B~1.EXE File opened for modification C:\Windows\svchost.com A1662B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys A1662B~1.EXE File opened for modification C:\Windows\directx.sys A1662B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com A1662B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com A1662B~1.EXE File opened for modification C:\Windows\directx.sys A1662B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys A1662B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys A1662B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com A1662B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com A1662B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com A1662B~1.EXE File opened for modification C:\Windows\directx.sys A1662B~1.EXE File opened for modification C:\Windows\directx.sys A1662B~1.EXE File opened for modification C:\Windows\directx.sys A1662B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys A1662B~1.EXE File opened for modification C:\Windows\svchost.com A1662B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys A1662B~1.EXE File opened for modification C:\Windows\directx.sys A1662B~1.EXE File opened for modification C:\Windows\directx.sys A1662B~1.EXE File opened for modification C:\Windows\directx.sys A1662B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com A1662B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exesvchost.exea1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exea1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exesvchost.exea1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exesvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEsvchost.comA1662B~1.EXEdescription pid process target process PID 1580 wrote to memory of 1692 1580 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe svchost.exe PID 1580 wrote to memory of 1692 1580 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe svchost.exe PID 1580 wrote to memory of 1692 1580 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe svchost.exe PID 1580 wrote to memory of 1692 1580 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe svchost.exe PID 1692 wrote to memory of 1048 1692 svchost.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe PID 1692 wrote to memory of 1048 1692 svchost.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe PID 1692 wrote to memory of 1048 1692 svchost.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe PID 1692 wrote to memory of 1048 1692 svchost.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe PID 1048 wrote to memory of 1740 1048 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe PID 1048 wrote to memory of 1740 1048 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe PID 1048 wrote to memory of 1740 1048 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe PID 1048 wrote to memory of 1740 1048 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe PID 1740 wrote to memory of 1760 1740 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe svchost.exe PID 1740 wrote to memory of 1760 1740 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe svchost.exe PID 1740 wrote to memory of 1760 1740 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe svchost.exe PID 1740 wrote to memory of 1760 1740 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe svchost.exe PID 1760 wrote to memory of 360 1760 svchost.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe PID 1760 wrote to memory of 360 1760 svchost.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe PID 1760 wrote to memory of 360 1760 svchost.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe PID 1760 wrote to memory of 360 1760 svchost.exe a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe PID 360 wrote to memory of 1828 360 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe svchost.com PID 360 wrote to memory of 1828 360 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe svchost.com PID 360 wrote to memory of 1828 360 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe svchost.com PID 360 wrote to memory of 1828 360 a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe svchost.com PID 1828 wrote to memory of 1836 1828 svchost.com A1662B~1.EXE PID 1828 wrote to memory of 1836 1828 svchost.com A1662B~1.EXE PID 1828 wrote to memory of 1836 1828 svchost.com A1662B~1.EXE PID 1828 wrote to memory of 1836 1828 svchost.com A1662B~1.EXE PID 1836 wrote to memory of 1556 1836 A1662B~1.EXE svchost.com PID 1836 wrote to memory of 1556 1836 A1662B~1.EXE svchost.com PID 1836 wrote to memory of 1556 1836 A1662B~1.EXE svchost.com PID 1836 wrote to memory of 1556 1836 A1662B~1.EXE svchost.com PID 1556 wrote to memory of 1560 1556 svchost.com A1662B~1.EXE PID 1556 wrote to memory of 1560 1556 svchost.com A1662B~1.EXE PID 1556 wrote to memory of 1560 1556 svchost.com A1662B~1.EXE PID 1556 wrote to memory of 1560 1556 svchost.com A1662B~1.EXE PID 1560 wrote to memory of 1960 1560 A1662B~1.EXE svchost.com PID 1560 wrote to memory of 1960 1560 A1662B~1.EXE svchost.com PID 1560 wrote to memory of 1960 1560 A1662B~1.EXE svchost.com PID 1560 wrote to memory of 1960 1560 A1662B~1.EXE svchost.com PID 1960 wrote to memory of 1728 1960 svchost.com A1662B~1.EXE PID 1960 wrote to memory of 1728 1960 svchost.com A1662B~1.EXE PID 1960 wrote to memory of 1728 1960 svchost.com A1662B~1.EXE PID 1960 wrote to memory of 1728 1960 svchost.com A1662B~1.EXE PID 1728 wrote to memory of 384 1728 A1662B~1.EXE svchost.com PID 1728 wrote to memory of 384 1728 A1662B~1.EXE svchost.com PID 1728 wrote to memory of 384 1728 A1662B~1.EXE svchost.com PID 1728 wrote to memory of 384 1728 A1662B~1.EXE svchost.com PID 384 wrote to memory of 276 384 svchost.com A1662B~1.EXE PID 384 wrote to memory of 276 384 svchost.com A1662B~1.EXE PID 384 wrote to memory of 276 384 svchost.com A1662B~1.EXE PID 384 wrote to memory of 276 384 svchost.com A1662B~1.EXE PID 276 wrote to memory of 924 276 A1662B~1.EXE svchost.com PID 276 wrote to memory of 924 276 A1662B~1.EXE svchost.com PID 276 wrote to memory of 924 276 A1662B~1.EXE svchost.com PID 276 wrote to memory of 924 276 A1662B~1.EXE svchost.com PID 924 wrote to memory of 1180 924 svchost.com A1662B~1.EXE PID 924 wrote to memory of 1180 924 svchost.com A1662B~1.EXE PID 924 wrote to memory of 1180 924 svchost.com A1662B~1.EXE PID 924 wrote to memory of 1180 924 svchost.com A1662B~1.EXE PID 1180 wrote to memory of 1792 1180 A1662B~1.EXE svchost.com PID 1180 wrote to memory of 1792 1180 A1662B~1.EXE svchost.com PID 1180 wrote to memory of 1792 1180 A1662B~1.EXE svchost.com PID 1180 wrote to memory of 1792 1180 A1662B~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe"C:\Users\Admin\AppData\Local\Temp\tmp\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\tmp\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe"C:\Users\Admin\AppData\Local\Temp\tmp\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe"3⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\a1662be5-74e9-4a9b-9662-ca7666ba82c8_1002.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE8⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE18⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE20⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE22⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE24⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE26⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE28⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE30⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE32⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE34⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE36⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE38⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE40⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE42⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE44⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE46⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE48⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE50⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE52⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE54⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE56⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE58⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE60⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"61⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE62⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"63⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE64⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"65⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE66⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"67⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE68⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"69⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE70⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"71⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE72⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"73⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE74⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"75⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE76⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"77⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE78⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"79⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE80⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"81⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE82⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"83⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE84⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"85⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE86⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"87⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE88⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"89⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE90⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"91⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE92⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"93⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE94⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"95⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE96⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"97⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE98⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"99⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE100⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"101⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE102⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"103⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE104⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"105⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE106⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"107⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE108⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"109⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE110⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"111⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE112⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"113⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE114⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"115⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE116⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"117⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE118⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"119⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE120⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"121⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE122⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"123⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE124⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"125⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE126⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"127⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE128⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"129⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE130⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"131⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE132⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"133⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE134⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"135⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE136⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"137⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE138⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"139⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE140⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"141⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE142⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"143⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE144⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"145⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE146⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"147⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE148⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"149⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE150⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"151⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE152⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"153⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE154⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"155⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE156⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"157⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE158⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"159⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE160⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"161⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE162⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"163⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE164⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"165⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE166⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"167⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE168⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"169⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE170⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"171⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE172⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"173⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE174⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"175⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE176⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"177⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE178⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"179⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE180⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"181⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE182⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"183⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE184⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"185⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE186⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"187⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE188⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"189⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE190⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"191⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE192⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"193⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE194⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"195⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE196⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"197⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE198⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"199⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE200⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"201⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE202⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"203⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE204⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"205⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE206⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"207⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE208⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"209⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE210⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"211⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE212⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"213⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE214⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"215⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE216⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"217⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE218⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"219⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE220⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"221⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE222⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"223⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE224⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"225⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE226⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"227⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE228⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"229⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE230⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"231⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE232⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"233⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE234⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"235⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE236⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"237⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE238⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"239⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE240⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A1662B~1.EXE"241⤵