Analysis
-
max time kernel
133s -
max time network
125s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-12-2021 05:10
Static task
static1
Behavioral task
behavioral1
Sample
tmp/44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
tmp/44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe
Resource
win10-en-20211208
General
-
Target
tmp/44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe
-
Size
2.5MB
-
MD5
606adb006089363b2be9638a921fdbb5
-
SHA1
7c423f710d6cf5a499fc7ccd8bc3ea4d2c8914ad
-
SHA256
c932b542b49acba2270fd3cea64bb7151f2878fc388816261fea1d7e6a0eb821
-
SHA512
87442c663b6eeaffad842a12f1c08b2ed8b76749443c734a9cef30175a97dff80a77f1a553a6312853df16f728dbd629baa4c9868393e5e6e4e60f4e1b4575d4
Malware Config
Signatures
-
Detect Neshta Payload 42 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta C:\Windows\svchost.com family_neshta C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe family_neshta C:\Windows\svchost.com family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exesvchost.exe44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exesvchost.comsvchost.exe44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEpid process 820 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe 884 svchost.exe 564 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe 1528 svchost.com 560 svchost.exe 868 44281F~1.EXE 1132 svchost.com 1384 44281F~1.EXE 1284 svchost.com 1364 44281F~1.EXE 1700 svchost.com 536 44281F~1.EXE 1968 svchost.com 1728 44281F~1.EXE 876 svchost.com 2020 44281F~1.EXE 516 svchost.com 1744 44281F~1.EXE 1472 svchost.com 316 44281F~1.EXE 1200 svchost.com 868 44281F~1.EXE 1360 svchost.com 1304 44281F~1.EXE 1664 svchost.com 920 44281F~1.EXE 1284 svchost.com 2036 44281F~1.EXE 1956 svchost.com 744 44281F~1.EXE 1480 svchost.com 1940 44281F~1.EXE 892 svchost.com 1736 44281F~1.EXE 836 svchost.com 1252 44281F~1.EXE 1612 svchost.com 844 44281F~1.EXE 716 svchost.com 808 44281F~1.EXE 528 svchost.com 360 44281F~1.EXE 1792 svchost.com 652 44281F~1.EXE 1132 svchost.com 1552 44281F~1.EXE 1680 svchost.com 1948 44281F~1.EXE 1364 svchost.com 1284 44281F~1.EXE 612 svchost.com 1780 44281F~1.EXE 1876 svchost.com 908 44281F~1.EXE 1724 svchost.com 1732 44281F~1.EXE 820 svchost.com 1576 44281F~1.EXE 584 svchost.com 1484 44281F~1.EXE 1276 svchost.com 1044 44281F~1.EXE 568 svchost.com 2000 44281F~1.EXE -
Loads dropped DLL 64 IoCs
Processes:
44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exesvchost.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.compid process 1688 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe 1688 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe 884 svchost.exe 884 svchost.exe 1528 svchost.com 1528 svchost.com 1132 svchost.com 1132 svchost.com 1284 svchost.com 1284 svchost.com 1700 svchost.com 1700 svchost.com 1968 svchost.com 1968 svchost.com 876 svchost.com 876 svchost.com 516 svchost.com 516 svchost.com 1472 svchost.com 1472 svchost.com 1200 svchost.com 1200 svchost.com 1360 svchost.com 1360 svchost.com 1664 svchost.com 1664 svchost.com 1284 svchost.com 1284 svchost.com 1956 svchost.com 1956 svchost.com 1480 svchost.com 1480 svchost.com 892 svchost.com 892 svchost.com 836 svchost.com 836 svchost.com 1612 svchost.com 1612 svchost.com 716 svchost.com 716 svchost.com 528 svchost.com 528 svchost.com 1792 svchost.com 1792 svchost.com 1132 svchost.com 1132 svchost.com 1680 svchost.com 1680 svchost.com 1688 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe 1364 svchost.com 1364 svchost.com 564 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe 1688 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe 612 svchost.com 612 svchost.com 1876 svchost.com 1876 svchost.com 1724 svchost.com 1724 svchost.com 564 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe 820 svchost.com 820 svchost.com 584 svchost.com 584 svchost.com -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exedescription ioc process File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe -
Drops file in Windows directory 64 IoCs
Processes:
svchost.comsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXE44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXE44281F~1.EXEsvchost.comsvchost.comsvchost.com44281F~1.EXEsvchost.comsvchost.comsvchost.com44281F~1.EXE44281F~1.EXE44281F~1.EXE44281F~1.EXE44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe44281F~1.EXE44281F~1.EXEsvchost.com44281F~1.EXE44281F~1.EXE44281F~1.EXEsvchost.com44281F~1.EXE44281F~1.EXE44281F~1.EXEsvchost.com44281F~1.EXE44281F~1.EXE44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXE44281F~1.EXEsvchost.com44281F~1.EXEsvchost.comsvchost.com44281F~1.EXE44281F~1.EXE44281F~1.EXE44281F~1.EXEsvchost.com44281F~1.EXE44281F~1.EXE44281F~1.EXE44281F~1.EXEsvchost.comsvchost.com44281F~1.EXEsvchost.comsvchost.com44281F~1.EXEdescription ioc process File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 44281F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 44281F~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 44281F~1.EXE File opened for modification C:\Windows\svchost.com 44281F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 44281F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 44281F~1.EXE File opened for modification C:\Windows\directx.sys 44281F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 44281F~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 44281F~1.EXE File opened for modification C:\Windows\svchost.com 44281F~1.EXE File opened for modification C:\Windows\svchost.com 44281F~1.EXE File opened for modification C:\Windows\svchost.com 44281F~1.EXE File opened for modification C:\Windows\svchost.com 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe File opened for modification C:\Windows\directx.sys 44281F~1.EXE File opened for modification C:\Windows\svchost.com 44281F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 44281F~1.EXE File opened for modification C:\Windows\directx.sys 44281F~1.EXE File opened for modification C:\Windows\svchost.com 44281F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 44281F~1.EXE File opened for modification C:\Windows\directx.sys 44281F~1.EXE File opened for modification C:\Windows\directx.sys 44281F~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 44281F~1.EXE File opened for modification C:\Windows\directx.sys 44281F~1.EXE File opened for modification C:\Windows\directx.sys 44281F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 44281F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 44281F~1.EXE File opened for modification C:\Windows\svchost.com 44281F~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 44281F~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 44281F~1.EXE File opened for modification C:\Windows\directx.sys 44281F~1.EXE File opened for modification C:\Windows\directx.sys 44281F~1.EXE File opened for modification C:\Windows\svchost.com 44281F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 44281F~1.EXE File opened for modification C:\Windows\directx.sys 44281F~1.EXE File opened for modification C:\Windows\svchost.com 44281F~1.EXE File opened for modification C:\Windows\directx.sys 44281F~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 44281F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 44281F~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exesvchost.exe44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exesvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.com44281F~1.EXEsvchost.comsvchost.comdescription pid process target process PID 1688 wrote to memory of 820 1688 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe PID 1688 wrote to memory of 820 1688 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe PID 1688 wrote to memory of 820 1688 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe PID 1688 wrote to memory of 820 1688 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe PID 820 wrote to memory of 884 820 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe svchost.exe PID 820 wrote to memory of 884 820 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe svchost.exe PID 820 wrote to memory of 884 820 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe svchost.exe PID 820 wrote to memory of 884 820 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe svchost.exe PID 884 wrote to memory of 564 884 svchost.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe PID 884 wrote to memory of 564 884 svchost.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe PID 884 wrote to memory of 564 884 svchost.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe PID 884 wrote to memory of 564 884 svchost.exe 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe PID 564 wrote to memory of 1528 564 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe svchost.com PID 564 wrote to memory of 1528 564 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe svchost.com PID 564 wrote to memory of 1528 564 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe svchost.com PID 564 wrote to memory of 1528 564 44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe svchost.com PID 1528 wrote to memory of 868 1528 svchost.com 44281F~1.EXE PID 1528 wrote to memory of 868 1528 svchost.com 44281F~1.EXE PID 1528 wrote to memory of 868 1528 svchost.com 44281F~1.EXE PID 1528 wrote to memory of 868 1528 svchost.com 44281F~1.EXE PID 868 wrote to memory of 1132 868 44281F~1.EXE svchost.com PID 868 wrote to memory of 1132 868 44281F~1.EXE svchost.com PID 868 wrote to memory of 1132 868 44281F~1.EXE svchost.com PID 868 wrote to memory of 1132 868 44281F~1.EXE svchost.com PID 1132 wrote to memory of 1384 1132 svchost.com 44281F~1.EXE PID 1132 wrote to memory of 1384 1132 svchost.com 44281F~1.EXE PID 1132 wrote to memory of 1384 1132 svchost.com 44281F~1.EXE PID 1132 wrote to memory of 1384 1132 svchost.com 44281F~1.EXE PID 1384 wrote to memory of 1284 1384 44281F~1.EXE svchost.com PID 1384 wrote to memory of 1284 1384 44281F~1.EXE svchost.com PID 1384 wrote to memory of 1284 1384 44281F~1.EXE svchost.com PID 1384 wrote to memory of 1284 1384 44281F~1.EXE svchost.com PID 1284 wrote to memory of 1364 1284 svchost.com 44281F~1.EXE PID 1284 wrote to memory of 1364 1284 svchost.com 44281F~1.EXE PID 1284 wrote to memory of 1364 1284 svchost.com 44281F~1.EXE PID 1284 wrote to memory of 1364 1284 svchost.com 44281F~1.EXE PID 1364 wrote to memory of 1700 1364 44281F~1.EXE svchost.com PID 1364 wrote to memory of 1700 1364 44281F~1.EXE svchost.com PID 1364 wrote to memory of 1700 1364 44281F~1.EXE svchost.com PID 1364 wrote to memory of 1700 1364 44281F~1.EXE svchost.com PID 1700 wrote to memory of 536 1700 svchost.com 44281F~1.EXE PID 1700 wrote to memory of 536 1700 svchost.com 44281F~1.EXE PID 1700 wrote to memory of 536 1700 svchost.com 44281F~1.EXE PID 1700 wrote to memory of 536 1700 svchost.com 44281F~1.EXE PID 536 wrote to memory of 1968 536 44281F~1.EXE svchost.com PID 536 wrote to memory of 1968 536 44281F~1.EXE svchost.com PID 536 wrote to memory of 1968 536 44281F~1.EXE svchost.com PID 536 wrote to memory of 1968 536 44281F~1.EXE svchost.com PID 1968 wrote to memory of 1728 1968 svchost.com 44281F~1.EXE PID 1968 wrote to memory of 1728 1968 svchost.com 44281F~1.EXE PID 1968 wrote to memory of 1728 1968 svchost.com 44281F~1.EXE PID 1968 wrote to memory of 1728 1968 svchost.com 44281F~1.EXE PID 1728 wrote to memory of 876 1728 44281F~1.EXE svchost.com PID 1728 wrote to memory of 876 1728 44281F~1.EXE svchost.com PID 1728 wrote to memory of 876 1728 44281F~1.EXE svchost.com PID 1728 wrote to memory of 876 1728 44281F~1.EXE svchost.com PID 876 wrote to memory of 2020 876 svchost.com 44281F~1.EXE PID 876 wrote to memory of 2020 876 svchost.com 44281F~1.EXE PID 876 wrote to memory of 2020 876 svchost.com 44281F~1.EXE PID 876 wrote to memory of 2020 876 svchost.com 44281F~1.EXE PID 516 wrote to memory of 1744 516 svchost.com 44281F~1.EXE PID 516 wrote to memory of 1744 516 svchost.com 44281F~1.EXE PID 516 wrote to memory of 1744 516 svchost.com 44281F~1.EXE PID 516 wrote to memory of 1744 516 svchost.com 44281F~1.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe"C:\Users\Admin\AppData\Local\Temp\tmp\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\44281f6f-da9d-409d-b3d5-f6214f797be4_1004.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE16⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE18⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE20⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE22⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE24⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE26⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE28⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE30⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE32⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE34⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE36⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE38⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE40⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE42⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE44⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE46⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE48⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE50⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE52⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE54⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE56⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE58⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE60⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"61⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE62⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"63⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE64⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"65⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE66⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"67⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE68⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"69⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE70⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"71⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE72⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"73⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE74⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"75⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE76⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"77⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE78⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"79⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE80⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"81⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE82⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"83⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE84⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"85⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE86⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"87⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE88⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"89⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE90⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"91⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE92⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"93⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE94⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"95⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE96⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"97⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE98⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"99⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE100⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"101⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE102⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"103⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE104⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"105⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE106⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"107⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE108⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"109⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE110⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"111⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE112⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"113⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE114⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"115⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE116⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"117⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE118⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"119⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE120⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"121⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE122⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"123⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE124⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"125⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE126⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"127⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE128⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"129⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE130⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"131⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE132⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"133⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE134⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"135⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE136⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"137⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE138⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"139⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE140⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"141⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE142⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"143⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE144⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"145⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE146⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"147⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE148⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"149⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE150⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"151⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE152⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"153⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE154⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"155⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE156⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"157⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE158⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"159⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE160⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"161⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE162⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"163⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE164⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"165⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE166⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"167⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE168⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"169⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE170⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"171⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE172⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"173⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE174⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"175⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE176⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"177⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE178⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"179⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE180⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"181⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE182⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"183⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE184⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"185⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE186⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"187⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE188⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"189⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE190⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"191⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE192⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"193⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE194⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"195⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE196⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"197⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE198⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"199⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE200⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"201⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE202⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"203⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE204⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"205⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE206⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"207⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE208⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"209⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE210⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"211⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE212⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"213⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE214⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"215⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE216⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"217⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE218⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"219⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE220⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"221⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE222⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"223⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE224⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"225⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE226⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"227⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE228⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"229⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE230⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"231⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE232⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"233⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE234⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"235⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE236⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"237⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE238⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"239⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE240⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\44281F~1.EXE"241⤵