Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-12-2021 05:09
Static task
static1
Behavioral task
behavioral1
Sample
tmp/c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
tmp/c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe
Resource
win10-en-20211208
General
-
Target
tmp/c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe
-
Size
930KB
-
MD5
f216fec248b643e7def093cb7fdddb2c
-
SHA1
e13794371af188551bdd02e4d569d71b51fae2d3
-
SHA256
f3e9c213d0e32dc314919c6932b1924d7c97c82c5dcb846179436f75660381d1
-
SHA512
b1de56cd14f7a6cc708b46e7b764538abc78b8d309be6ee5c3923a6152cca044bf945f726c9922566ab793c57adc76f90dedb8bf5fd4a2f2a091c73fb6c062e6
Malware Config
Signatures
-
Detect Neshta Payload 37 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\tmp\c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe family_neshta C:\Users\Admin\AppData\Local\Temp\tmp\c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\odt\OFFICE~1.EXE family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe family_neshta C:\Windows\svchost.com family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
svchost.exec6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exesvchost.exec6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exesvchost.exec6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exesvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEpid process 3504 svchost.exe 3676 c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe 3652 svchost.exe 780 c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe 4024 svchost.exe 4032 c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe 3980 svchost.com 4212 C6DFFC~1.EXE 4332 svchost.com 4388 C6DFFC~1.EXE 4340 svchost.com 4320 C6DFFC~1.EXE 4412 svchost.com 4508 C6DFFC~1.EXE 3320 svchost.com 540 C6DFFC~1.EXE 884 svchost.com 444 C6DFFC~1.EXE 1180 svchost.com 1312 C6DFFC~1.EXE 1608 svchost.com 1836 C6DFFC~1.EXE 2104 svchost.com 2264 C6DFFC~1.EXE 2648 svchost.com 2964 C6DFFC~1.EXE 4256 svchost.com 4776 C6DFFC~1.EXE 4892 svchost.com 4912 C6DFFC~1.EXE 2608 svchost.com 3592 C6DFFC~1.EXE 4844 svchost.com 4576 C6DFFC~1.EXE 4280 svchost.com 4284 C6DFFC~1.EXE 2628 svchost.com 2364 C6DFFC~1.EXE 1100 svchost.com 2092 C6DFFC~1.EXE 2436 svchost.com 1236 C6DFFC~1.EXE 4584 svchost.com 4732 C6DFFC~1.EXE 3724 svchost.com 996 C6DFFC~1.EXE 1340 svchost.com 1240 C6DFFC~1.EXE 1580 svchost.com 1680 C6DFFC~1.EXE 1948 svchost.com 1976 C6DFFC~1.EXE 4416 svchost.com 4240 C6DFFC~1.EXE 3552 svchost.com 1716 C6DFFC~1.EXE 1444 svchost.com 2584 C6DFFC~1.EXE 1632 svchost.com 3688 C6DFFC~1.EXE 3252 svchost.com 3204 C6DFFC~1.EXE 2136 svchost.com 4984 C6DFFC~1.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exesvchost.exec6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exedescription ioc process File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe svchost.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe svchost.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE svchost.exe File opened for modification C:\Program Files\7-Zip\7zG.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe svchost.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe -
Drops file in Windows directory 64 IoCs
Processes:
C6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comsvchost.comC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comC6DFFC~1.EXEsvchost.comsvchost.comC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEsvchost.comsvchost.comC6DFFC~1.EXEsvchost.comsvchost.comC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEC6DFFC~1.EXEc6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exesvchost.comsvchost.comsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEC6DFFC~1.EXEsvchost.comsvchost.comC6DFFC~1.EXEsvchost.comsvchost.comC6DFFC~1.EXEsvchost.comdescription ioc process File opened for modification C:\Windows\svchost.com C6DFFC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com C6DFFC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com C6DFFC~1.EXE File opened for modification C:\Windows\directx.sys C6DFFC~1.EXE File opened for modification C:\Windows\directx.sys C6DFFC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys C6DFFC~1.EXE File opened for modification C:\Windows\svchost.com C6DFFC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com C6DFFC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys C6DFFC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys C6DFFC~1.EXE File opened for modification C:\Windows\svchost.com C6DFFC~1.EXE File opened for modification C:\Windows\directx.sys C6DFFC~1.EXE File opened for modification C:\Windows\directx.sys C6DFFC~1.EXE File opened for modification C:\Windows\directx.sys C6DFFC~1.EXE File opened for modification C:\Windows\directx.sys C6DFFC~1.EXE File opened for modification C:\Windows\svchost.com C6DFFC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com C6DFFC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys C6DFFC~1.EXE File opened for modification C:\Windows\directx.sys C6DFFC~1.EXE File opened for modification C:\Windows\svchost.com C6DFFC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com C6DFFC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com C6DFFC~1.EXE File opened for modification C:\Windows\directx.sys C6DFFC~1.EXE File opened for modification C:\Windows\svchost.com C6DFFC~1.EXE File opened for modification C:\Windows\svchost.com C6DFFC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com C6DFFC~1.EXE File opened for modification C:\Windows\directx.sys C6DFFC~1.EXE File opened for modification C:\Windows\directx.sys c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com C6DFFC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com C6DFFC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com C6DFFC~1.EXE File opened for modification C:\Windows\directx.sys C6DFFC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys C6DFFC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com C6DFFC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
Processes:
C6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEc6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exeC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEC6DFFC~1.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings svchost.com Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings svchost.com Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C6DFFC~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exesvchost.exec6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exec6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exesvchost.exec6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exesvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEsvchost.comC6DFFC~1.EXEdescription pid process target process PID 3376 wrote to memory of 3504 3376 c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe svchost.exe PID 3376 wrote to memory of 3504 3376 c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe svchost.exe PID 3376 wrote to memory of 3504 3376 c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe svchost.exe PID 3504 wrote to memory of 3676 3504 svchost.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe PID 3504 wrote to memory of 3676 3504 svchost.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe PID 3504 wrote to memory of 3676 3504 svchost.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe PID 3676 wrote to memory of 780 3676 c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe PID 3676 wrote to memory of 780 3676 c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe PID 3676 wrote to memory of 780 3676 c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe PID 780 wrote to memory of 4024 780 c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe svchost.exe PID 780 wrote to memory of 4024 780 c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe svchost.exe PID 780 wrote to memory of 4024 780 c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe svchost.exe PID 4024 wrote to memory of 4032 4024 svchost.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe PID 4024 wrote to memory of 4032 4024 svchost.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe PID 4024 wrote to memory of 4032 4024 svchost.exe c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe PID 4032 wrote to memory of 3980 4032 c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe svchost.com PID 4032 wrote to memory of 3980 4032 c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe svchost.com PID 4032 wrote to memory of 3980 4032 c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe svchost.com PID 3980 wrote to memory of 4212 3980 svchost.com C6DFFC~1.EXE PID 3980 wrote to memory of 4212 3980 svchost.com C6DFFC~1.EXE PID 3980 wrote to memory of 4212 3980 svchost.com C6DFFC~1.EXE PID 4212 wrote to memory of 4332 4212 C6DFFC~1.EXE svchost.com PID 4212 wrote to memory of 4332 4212 C6DFFC~1.EXE svchost.com PID 4212 wrote to memory of 4332 4212 C6DFFC~1.EXE svchost.com PID 4332 wrote to memory of 4388 4332 svchost.com C6DFFC~1.EXE PID 4332 wrote to memory of 4388 4332 svchost.com C6DFFC~1.EXE PID 4332 wrote to memory of 4388 4332 svchost.com C6DFFC~1.EXE PID 4388 wrote to memory of 4340 4388 C6DFFC~1.EXE svchost.com PID 4388 wrote to memory of 4340 4388 C6DFFC~1.EXE svchost.com PID 4388 wrote to memory of 4340 4388 C6DFFC~1.EXE svchost.com PID 4340 wrote to memory of 4320 4340 svchost.com C6DFFC~1.EXE PID 4340 wrote to memory of 4320 4340 svchost.com C6DFFC~1.EXE PID 4340 wrote to memory of 4320 4340 svchost.com C6DFFC~1.EXE PID 4320 wrote to memory of 4412 4320 C6DFFC~1.EXE svchost.com PID 4320 wrote to memory of 4412 4320 C6DFFC~1.EXE svchost.com PID 4320 wrote to memory of 4412 4320 C6DFFC~1.EXE svchost.com PID 4412 wrote to memory of 4508 4412 svchost.com C6DFFC~1.EXE PID 4412 wrote to memory of 4508 4412 svchost.com C6DFFC~1.EXE PID 4412 wrote to memory of 4508 4412 svchost.com C6DFFC~1.EXE PID 4508 wrote to memory of 3320 4508 C6DFFC~1.EXE svchost.com PID 4508 wrote to memory of 3320 4508 C6DFFC~1.EXE svchost.com PID 4508 wrote to memory of 3320 4508 C6DFFC~1.EXE svchost.com PID 3320 wrote to memory of 540 3320 svchost.com C6DFFC~1.EXE PID 3320 wrote to memory of 540 3320 svchost.com C6DFFC~1.EXE PID 3320 wrote to memory of 540 3320 svchost.com C6DFFC~1.EXE PID 540 wrote to memory of 884 540 C6DFFC~1.EXE svchost.com PID 540 wrote to memory of 884 540 C6DFFC~1.EXE svchost.com PID 540 wrote to memory of 884 540 C6DFFC~1.EXE svchost.com PID 884 wrote to memory of 444 884 svchost.com C6DFFC~1.EXE PID 884 wrote to memory of 444 884 svchost.com C6DFFC~1.EXE PID 884 wrote to memory of 444 884 svchost.com C6DFFC~1.EXE PID 444 wrote to memory of 1180 444 C6DFFC~1.EXE svchost.com PID 444 wrote to memory of 1180 444 C6DFFC~1.EXE svchost.com PID 444 wrote to memory of 1180 444 C6DFFC~1.EXE svchost.com PID 1180 wrote to memory of 1312 1180 svchost.com C6DFFC~1.EXE PID 1180 wrote to memory of 1312 1180 svchost.com C6DFFC~1.EXE PID 1180 wrote to memory of 1312 1180 svchost.com C6DFFC~1.EXE PID 1312 wrote to memory of 1608 1312 C6DFFC~1.EXE svchost.com PID 1312 wrote to memory of 1608 1312 C6DFFC~1.EXE svchost.com PID 1312 wrote to memory of 1608 1312 C6DFFC~1.EXE svchost.com PID 1608 wrote to memory of 1836 1608 svchost.com C6DFFC~1.EXE PID 1608 wrote to memory of 1836 1608 svchost.com C6DFFC~1.EXE PID 1608 wrote to memory of 1836 1608 svchost.com C6DFFC~1.EXE PID 1836 wrote to memory of 2104 1836 C6DFFC~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp\c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe"C:\Users\Admin\AppData\Local\Temp\tmp\c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\tmp\c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp\c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe"C:\Users\Admin\AppData\Local\Temp\tmp\c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe"3⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\c6dffc4e-7a0d-4cb0-9a3a-b3e327e0d1dd_1003.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE10⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"23⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE24⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"25⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE26⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"27⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE28⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"29⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE30⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"31⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE32⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"33⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE34⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"35⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE36⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"37⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE38⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"39⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE40⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"41⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE42⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"43⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE44⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"45⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE46⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"47⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE48⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"49⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE50⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"51⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE52⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"53⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE54⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"55⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE56⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"57⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE58⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"59⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE60⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"61⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE62⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"63⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE64⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"65⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE66⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"67⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE68⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"69⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE70⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"71⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE72⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"73⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE74⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"75⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE76⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"77⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE78⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"79⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE80⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"81⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE82⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"83⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE84⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"85⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE86⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"87⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE88⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"89⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE90⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"91⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE92⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"93⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE94⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"95⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE96⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"97⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE98⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"99⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE100⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"101⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE102⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"103⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE104⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"105⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE106⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"107⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE108⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"109⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE110⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"111⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE112⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"113⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE114⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"115⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE116⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"117⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE118⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"119⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE120⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"121⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE122⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"123⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE124⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"125⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE126⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"127⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE128⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"129⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE130⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"131⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE132⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"133⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE134⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"135⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE136⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"137⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE138⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"139⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE140⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"141⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE142⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"143⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE144⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"145⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE146⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"147⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE148⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"149⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE150⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"151⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE152⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"153⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE154⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"155⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE156⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"157⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE158⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"159⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE160⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"161⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE162⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"163⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE164⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"165⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE166⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"167⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE168⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"169⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE170⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"171⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE172⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"173⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE174⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"175⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE176⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"177⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE178⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"179⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE180⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"181⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE182⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"183⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE184⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"185⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE186⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"187⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE188⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"189⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE190⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"191⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE192⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"193⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE194⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"195⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE196⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"197⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE198⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"199⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE200⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"201⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE202⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"203⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE204⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"205⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE206⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"207⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE208⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"209⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE210⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"211⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE212⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"213⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE214⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"215⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE216⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"217⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE218⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"219⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE220⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"221⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE222⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"223⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE224⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"225⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE226⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"227⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE228⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"229⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE230⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"231⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE232⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"233⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE234⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"235⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE236⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"237⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE238⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"239⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE240⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\C6DFFC~1.EXE"241⤵