Analysis
-
max time kernel
139s -
max time network
120s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-12-2021 05:06
Static task
static1
Behavioral task
behavioral1
Sample
tmp/1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
tmp/1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe
Resource
win10-en-20211208
General
-
Target
tmp/1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe
-
Size
1.7MB
-
MD5
eb0cc50b9a99946a371324ba60e24ba0
-
SHA1
7a8d0f389c2b848923aefdfb5a6003195fecfc46
-
SHA256
0ee387071e3b12f2061d01dae97d410bd51e0b93335d57980f92678eafe564dc
-
SHA512
b3502d439d4e368db8b0fb52a6bbc54ad8d32832726c3540767f90ec0bfb94f3da8d22abab78b56923bd5486d9ee6eac9ad9bc31d1d50d8a8d8fa330e06d3efb
Malware Config
Signatures
-
Detect Neshta Payload 39 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\tmp\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta \Users\Admin\AppData\Local\Temp\tmp\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta C:\Users\Admin\AppData\Local\Temp\tmp\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta C:\Users\Admin\AppData\Local\Temp\tmp\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
svchost.exe1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exesvchost.exe1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exesvchost.exe1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exesvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEpid process 1592 svchost.exe 1272 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe 584 svchost.exe 1544 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe 876 svchost.exe 692 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe 776 svchost.com 1440 1B322D~1.EXE 828 svchost.com 888 1B322D~1.EXE 1156 svchost.com 1908 1B322D~1.EXE 1716 svchost.com 1164 1B322D~1.EXE 1876 svchost.com 920 1B322D~1.EXE 1996 svchost.com 1612 1B322D~1.EXE 952 svchost.com 780 1B322D~1.EXE 596 svchost.com 760 1B322D~1.EXE 432 svchost.com 748 1B322D~1.EXE 776 svchost.com 1180 1B322D~1.EXE 1524 svchost.com 828 1B322D~1.EXE 960 svchost.com 888 1B322D~1.EXE 1116 svchost.com 1624 1B322D~1.EXE 2008 svchost.com 1904 1B322D~1.EXE 1976 svchost.com 636 1B322D~1.EXE 1692 svchost.com 884 1B322D~1.EXE 1604 svchost.com 1228 1B322D~1.EXE 1636 svchost.com 1608 1B322D~1.EXE 1592 svchost.com 1452 1B322D~1.EXE 1588 svchost.com 1100 1B322D~1.EXE 760 svchost.com 1776 1B322D~1.EXE 748 svchost.com 1192 1B322D~1.EXE 1896 svchost.com 980 1B322D~1.EXE 1724 svchost.com 1728 1B322D~1.EXE 888 svchost.com 1908 1B322D~1.EXE 1936 svchost.com 1488 1B322D~1.EXE 240 svchost.com 1328 1B322D~1.EXE 636 svchost.com 1968 1B322D~1.EXE 1704 svchost.com 1680 1B322D~1.EXE -
Loads dropped DLL 64 IoCs
Processes:
svchost.exe1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exesvchost.exe1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.compid process 1592 svchost.exe 1592 svchost.exe 1272 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe 1272 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe 1272 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe 1272 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe 876 svchost.exe 876 svchost.exe 692 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe 692 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe 776 svchost.com 776 svchost.com 828 svchost.com 828 svchost.com 1156 svchost.com 1156 svchost.com 1716 svchost.com 1716 svchost.com 1876 svchost.com 1876 svchost.com 1996 svchost.com 1996 svchost.com 952 svchost.com 952 svchost.com 596 svchost.com 596 svchost.com 432 svchost.com 432 svchost.com 776 svchost.com 776 svchost.com 1524 svchost.com 1524 svchost.com 960 svchost.com 960 svchost.com 1116 svchost.com 1116 svchost.com 2008 svchost.com 2008 svchost.com 1976 svchost.com 1976 svchost.com 1692 svchost.com 1692 svchost.com 1604 svchost.com 1604 svchost.com 1636 svchost.com 1636 svchost.com 1272 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe 1592 svchost.com 1592 svchost.com 1588 svchost.com 1588 svchost.com 760 svchost.com 760 svchost.com 748 svchost.com 748 svchost.com 1896 svchost.com 1896 svchost.com 1724 svchost.com 1724 svchost.com 888 svchost.com 888 svchost.com 1936 svchost.com 1936 svchost.com 240 svchost.com -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exesvchost.exedescription ioc process File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe svchost.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe -
Drops file in Windows directory 64 IoCs
Processes:
1B322D~1.EXE1B322D~1.EXE1B322D~1.EXE1B322D~1.EXE1B322D~1.EXE1B322D~1.EXE1B322D~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com1B322D~1.EXEsvchost.comsvchost.comsvchost.com1B322D~1.EXE1B322D~1.EXE1B322D~1.EXEsvchost.comsvchost.com1B322D~1.EXE1B322D~1.EXE1B322D~1.EXE1B322D~1.EXEsvchost.com1B322D~1.EXE1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXE1B322D~1.EXE1B322D~1.EXE1B322D~1.EXE1B322D~1.EXEsvchost.com1B322D~1.EXE1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXE1B322D~1.EXE1B322D~1.EXE1B322D~1.EXEsvchost.comsvchost.com1B322D~1.EXEsvchost.comsvchost.com1B322D~1.EXE1B322D~1.EXE1B322D~1.EXE1B322D~1.EXE1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.comsvchost.com1B322D~1.EXE1B322D~1.EXEsvchost.com1B322D~1.EXEdescription ioc process File opened for modification C:\Windows\directx.sys 1B322D~1.EXE File opened for modification C:\Windows\svchost.com 1B322D~1.EXE File opened for modification C:\Windows\svchost.com 1B322D~1.EXE File opened for modification C:\Windows\directx.sys 1B322D~1.EXE File opened for modification C:\Windows\svchost.com 1B322D~1.EXE File opened for modification C:\Windows\directx.sys 1B322D~1.EXE File opened for modification C:\Windows\svchost.com 1B322D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 1B322D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 1B322D~1.EXE File opened for modification C:\Windows\directx.sys 1B322D~1.EXE File opened for modification C:\Windows\svchost.com 1B322D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 1B322D~1.EXE File opened for modification C:\Windows\svchost.com 1B322D~1.EXE File opened for modification C:\Windows\directx.sys 1B322D~1.EXE File opened for modification C:\Windows\svchost.com 1B322D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 1B322D~1.EXE File opened for modification C:\Windows\svchost.com 1B322D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 1B322D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 1B322D~1.EXE File opened for modification C:\Windows\directx.sys 1B322D~1.EXE File opened for modification C:\Windows\svchost.com 1B322D~1.EXE File opened for modification C:\Windows\directx.sys 1B322D~1.EXE File opened for modification C:\Windows\directx.sys 1B322D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 1B322D~1.EXE File opened for modification C:\Windows\directx.sys 1B322D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 1B322D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 1B322D~1.EXE File opened for modification C:\Windows\svchost.com 1B322D~1.EXE File opened for modification C:\Windows\svchost.com 1B322D~1.EXE File opened for modification C:\Windows\svchost.com 1B322D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 1B322D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 1B322D~1.EXE File opened for modification C:\Windows\svchost.com 1B322D~1.EXE File opened for modification C:\Windows\svchost.com 1B322D~1.EXE File opened for modification C:\Windows\directx.sys 1B322D~1.EXE File opened for modification C:\Windows\svchost.com 1B322D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 1B322D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 1B322D~1.EXE File opened for modification C:\Windows\directx.sys 1B322D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 1B322D~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exesvchost.exe1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exesvchost.exe1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exesvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEsvchost.com1B322D~1.EXEdescription pid process target process PID 1688 wrote to memory of 1592 1688 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe svchost.exe PID 1688 wrote to memory of 1592 1688 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe svchost.exe PID 1688 wrote to memory of 1592 1688 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe svchost.exe PID 1688 wrote to memory of 1592 1688 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe svchost.exe PID 1592 wrote to memory of 1272 1592 svchost.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe PID 1592 wrote to memory of 1272 1592 svchost.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe PID 1592 wrote to memory of 1272 1592 svchost.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe PID 1592 wrote to memory of 1272 1592 svchost.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe PID 1272 wrote to memory of 1544 1272 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe PID 1272 wrote to memory of 1544 1272 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe PID 1272 wrote to memory of 1544 1272 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe PID 1272 wrote to memory of 1544 1272 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe PID 1544 wrote to memory of 876 1544 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe svchost.exe PID 1544 wrote to memory of 876 1544 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe svchost.exe PID 1544 wrote to memory of 876 1544 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe svchost.exe PID 1544 wrote to memory of 876 1544 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe svchost.exe PID 876 wrote to memory of 692 876 svchost.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe PID 876 wrote to memory of 692 876 svchost.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe PID 876 wrote to memory of 692 876 svchost.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe PID 876 wrote to memory of 692 876 svchost.exe 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe PID 692 wrote to memory of 776 692 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe svchost.com PID 692 wrote to memory of 776 692 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe svchost.com PID 692 wrote to memory of 776 692 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe svchost.com PID 692 wrote to memory of 776 692 1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe svchost.com PID 776 wrote to memory of 1440 776 svchost.com 1B322D~1.EXE PID 776 wrote to memory of 1440 776 svchost.com 1B322D~1.EXE PID 776 wrote to memory of 1440 776 svchost.com 1B322D~1.EXE PID 776 wrote to memory of 1440 776 svchost.com 1B322D~1.EXE PID 1440 wrote to memory of 828 1440 1B322D~1.EXE svchost.com PID 1440 wrote to memory of 828 1440 1B322D~1.EXE svchost.com PID 1440 wrote to memory of 828 1440 1B322D~1.EXE svchost.com PID 1440 wrote to memory of 828 1440 1B322D~1.EXE svchost.com PID 828 wrote to memory of 888 828 svchost.com 1B322D~1.EXE PID 828 wrote to memory of 888 828 svchost.com 1B322D~1.EXE PID 828 wrote to memory of 888 828 svchost.com 1B322D~1.EXE PID 828 wrote to memory of 888 828 svchost.com 1B322D~1.EXE PID 888 wrote to memory of 1156 888 1B322D~1.EXE svchost.com PID 888 wrote to memory of 1156 888 1B322D~1.EXE svchost.com PID 888 wrote to memory of 1156 888 1B322D~1.EXE svchost.com PID 888 wrote to memory of 1156 888 1B322D~1.EXE svchost.com PID 1156 wrote to memory of 1908 1156 svchost.com 1B322D~1.EXE PID 1156 wrote to memory of 1908 1156 svchost.com 1B322D~1.EXE PID 1156 wrote to memory of 1908 1156 svchost.com 1B322D~1.EXE PID 1156 wrote to memory of 1908 1156 svchost.com 1B322D~1.EXE PID 1908 wrote to memory of 1716 1908 1B322D~1.EXE svchost.com PID 1908 wrote to memory of 1716 1908 1B322D~1.EXE svchost.com PID 1908 wrote to memory of 1716 1908 1B322D~1.EXE svchost.com PID 1908 wrote to memory of 1716 1908 1B322D~1.EXE svchost.com PID 1716 wrote to memory of 1164 1716 svchost.com 1B322D~1.EXE PID 1716 wrote to memory of 1164 1716 svchost.com 1B322D~1.EXE PID 1716 wrote to memory of 1164 1716 svchost.com 1B322D~1.EXE PID 1716 wrote to memory of 1164 1716 svchost.com 1B322D~1.EXE PID 1164 wrote to memory of 1876 1164 1B322D~1.EXE svchost.com PID 1164 wrote to memory of 1876 1164 1B322D~1.EXE svchost.com PID 1164 wrote to memory of 1876 1164 1B322D~1.EXE svchost.com PID 1164 wrote to memory of 1876 1164 1B322D~1.EXE svchost.com PID 1876 wrote to memory of 920 1876 svchost.com 1B322D~1.EXE PID 1876 wrote to memory of 920 1876 svchost.com 1B322D~1.EXE PID 1876 wrote to memory of 920 1876 svchost.com 1B322D~1.EXE PID 1876 wrote to memory of 920 1876 svchost.com 1B322D~1.EXE PID 920 wrote to memory of 1996 920 1B322D~1.EXE svchost.com PID 920 wrote to memory of 1996 920 1B322D~1.EXE svchost.com PID 920 wrote to memory of 1996 920 1B322D~1.EXE svchost.com PID 920 wrote to memory of 1996 920 1B322D~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe"C:\Users\Admin\AppData\Local\Temp\tmp\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\tmp\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe"C:\Users\Admin\AppData\Local\Temp\tmp\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe"3⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\1b322dfd-7176-487c-a27e-c9d01b4eca26_1001.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE8⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE14⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE18⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE20⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE22⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE24⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE26⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE28⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE30⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE32⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE34⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE36⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE38⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE40⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE42⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE44⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE46⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE48⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE50⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE52⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE54⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE56⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE58⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE60⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"61⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE62⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"63⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE64⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"65⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE66⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"67⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE68⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"69⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE70⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"71⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE72⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"73⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE74⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"75⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE76⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"77⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE78⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"79⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE80⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"81⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE82⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"83⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE84⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"85⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE86⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"87⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE88⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"89⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE90⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"91⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE92⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"93⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE94⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"95⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE96⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"97⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE98⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"99⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE100⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"101⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE102⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"103⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE104⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"105⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE106⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"107⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE108⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"109⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE110⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"111⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE112⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"113⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE114⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"115⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE116⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"117⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE118⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"119⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE120⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"121⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE122⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"123⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE124⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"125⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE126⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"127⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE128⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"129⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE130⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"131⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE132⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"133⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE134⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"135⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE136⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"137⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE138⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"139⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE140⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"141⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE142⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"143⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE144⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"145⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE146⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"147⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE148⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"149⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE150⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"151⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE152⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"153⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE154⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"155⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE156⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"157⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE158⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"159⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE160⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"161⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE162⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"163⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE164⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"165⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE166⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"167⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE168⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"169⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE170⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"171⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE172⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"173⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE174⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"175⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE176⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"177⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE178⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"179⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE180⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"181⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE182⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"183⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE184⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"185⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE186⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"187⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE188⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"189⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE190⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"191⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE192⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"193⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE194⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"195⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE196⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"197⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE198⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"199⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE200⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"201⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE202⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"203⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE204⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"205⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE206⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"207⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE208⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"209⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE210⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"211⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE212⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"213⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE214⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"215⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE216⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"217⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE218⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"219⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE220⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"221⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE222⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"223⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE224⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"225⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE226⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"227⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE228⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"229⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE230⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"231⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE232⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"233⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE234⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"235⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE236⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"237⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE238⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"239⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE240⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1B322D~1.EXE"241⤵