Analysis
-
max time kernel
138s -
max time network
128s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-12-2021 11:00
Static task
static1
Behavioral task
behavioral1
Sample
tmp/25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
tmp/25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe
Resource
win10-en-20211208
General
-
Target
tmp/25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe
-
Size
971KB
-
MD5
0f09c21dda0c397d72e388d46f03e777
-
SHA1
44c93d3f5e021a2c736f3b29e94342c1404fa549
-
SHA256
6afc05e16f34327163a5576483ec7a3c56ba26c762648b9b9261901382af4a65
-
SHA512
5af85c92b890bd7973938e683fda4097d72d220d5a3ba14d95592ce07ba118d09597d7539e6e3f9ed92ada5d136a942bdec061e057fb155276d294cc913213c4
Malware Config
Signatures
-
Detect Neshta Payload 42 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe family_neshta C:\Windows\svchost.com family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exesvchost.exe25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exesvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.exesvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEpid process 1572 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe 524 svchost.exe 540 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe 784 svchost.com 364 25E4A3~1.EXE 1100 svchost.com 1064 25E4A3~1.EXE 1660 svchost.com 1372 25E4A3~1.EXE 856 svchost.com 2024 25E4A3~1.EXE 700 svchost.exe 684 svchost.com 1468 25E4A3~1.EXE 1612 svchost.com 1244 25E4A3~1.EXE 1596 svchost.com 956 25E4A3~1.EXE 876 svchost.com 1124 25E4A3~1.EXE 1088 svchost.com 364 25E4A3~1.EXE 800 svchost.com 1532 25E4A3~1.EXE 1864 svchost.com 1708 25E4A3~1.EXE 1252 svchost.com 1608 25E4A3~1.EXE 1668 svchost.com 1692 25E4A3~1.EXE 240 svchost.com 1688 25E4A3~1.EXE 276 svchost.com 1796 25E4A3~1.EXE 2040 svchost.com 1624 25E4A3~1.EXE 1240 svchost.com 1600 25E4A3~1.EXE 1568 svchost.com 268 25E4A3~1.EXE 956 svchost.com 1464 25E4A3~1.EXE 1356 svchost.com 804 25E4A3~1.EXE 1632 svchost.com 1080 25E4A3~1.EXE 428 svchost.com 1484 25E4A3~1.EXE 1904 svchost.com 1180 25E4A3~1.EXE 1820 svchost.com 1708 25E4A3~1.EXE 1236 svchost.com 2032 25E4A3~1.EXE 1012 svchost.com 1880 25E4A3~1.EXE 1776 svchost.com 1868 25E4A3~1.EXE 1872 svchost.com 1960 25E4A3~1.EXE 1508 svchost.com 1592 25E4A3~1.EXE 1436 svchost.com 1752 25E4A3~1.EXE -
Loads dropped DLL 64 IoCs
Processes:
25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exesvchost.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exesvchost.comsvchost.comsvchost.comsvchost.compid process 1736 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe 1736 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe 524 svchost.exe 524 svchost.exe 784 svchost.com 784 svchost.com 1100 svchost.com 1100 svchost.com 1660 svchost.com 1660 svchost.com 856 svchost.com 856 svchost.com 684 svchost.com 684 svchost.com 1612 svchost.com 1612 svchost.com 1596 svchost.com 1596 svchost.com 876 svchost.com 876 svchost.com 1088 svchost.com 1088 svchost.com 800 svchost.com 800 svchost.com 1864 svchost.com 1864 svchost.com 1252 svchost.com 1252 svchost.com 1668 svchost.com 1668 svchost.com 240 svchost.com 240 svchost.com 276 svchost.com 276 svchost.com 2040 svchost.com 2040 svchost.com 1240 svchost.com 1240 svchost.com 1568 svchost.com 1568 svchost.com 956 svchost.com 956 svchost.com 1356 svchost.com 1356 svchost.com 1632 svchost.com 1632 svchost.com 428 svchost.com 428 svchost.com 1904 svchost.com 1904 svchost.com 1820 svchost.com 1820 svchost.com 540 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe 540 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe 540 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe 1236 svchost.com 1236 svchost.com 1012 svchost.com 1012 svchost.com 1736 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe 1776 svchost.com 1776 svchost.com 1872 svchost.com 1872 svchost.com -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exesvchost.exedescription ioc process File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe -
Drops file in Windows directory 64 IoCs
Processes:
25E4A3~1.EXEsvchost.comsvchost.com25E4A3~1.EXE25E4A3~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXE25E4A3~1.EXEsvchost.comsvchost.comsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.comsvchost.com25E4A3~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com25E4A3~1.EXEsvchost.comsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXE25E4A3~1.EXE25E4A3~1.EXE25E4A3~1.EXEsvchost.comsvchost.com25E4A3~1.EXEsvchost.comsvchost.com25E4A3~1.EXE25E4A3~1.EXEsvchost.comsvchost.com25E4A3~1.EXE25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEdescription ioc process File opened for modification C:\Windows\svchost.com 25E4A3~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 25E4A3~1.EXE File opened for modification C:\Windows\svchost.com 25E4A3~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 25E4A3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 25E4A3~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 25E4A3~1.EXE File opened for modification C:\Windows\directx.sys 25E4A3~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 25E4A3~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 25E4A3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 25E4A3~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 25E4A3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 25E4A3~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 25E4A3~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 25E4A3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 25E4A3~1.EXE File opened for modification C:\Windows\directx.sys 25E4A3~1.EXE File opened for modification C:\Windows\svchost.com 25E4A3~1.EXE File opened for modification C:\Windows\svchost.com 25E4A3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 25E4A3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 25E4A3~1.EXE File opened for modification C:\Windows\svchost.com 25E4A3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 25E4A3~1.EXE File opened for modification C:\Windows\directx.sys 25E4A3~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 25E4A3~1.EXE File opened for modification C:\Windows\svchost.com 25E4A3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 25E4A3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 25E4A3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 25E4A3~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exesvchost.exe25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exesvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEsvchost.com25E4A3~1.EXEdescription pid process target process PID 1736 wrote to memory of 1572 1736 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe PID 1736 wrote to memory of 1572 1736 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe PID 1736 wrote to memory of 1572 1736 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe PID 1736 wrote to memory of 1572 1736 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe PID 1572 wrote to memory of 524 1572 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe svchost.exe PID 1572 wrote to memory of 524 1572 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe svchost.exe PID 1572 wrote to memory of 524 1572 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe svchost.exe PID 1572 wrote to memory of 524 1572 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe svchost.exe PID 524 wrote to memory of 540 524 svchost.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe PID 524 wrote to memory of 540 524 svchost.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe PID 524 wrote to memory of 540 524 svchost.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe PID 524 wrote to memory of 540 524 svchost.exe 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe PID 540 wrote to memory of 784 540 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe svchost.com PID 540 wrote to memory of 784 540 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe svchost.com PID 540 wrote to memory of 784 540 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe svchost.com PID 540 wrote to memory of 784 540 25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe svchost.com PID 784 wrote to memory of 364 784 svchost.com 25E4A3~1.EXE PID 784 wrote to memory of 364 784 svchost.com 25E4A3~1.EXE PID 784 wrote to memory of 364 784 svchost.com 25E4A3~1.EXE PID 784 wrote to memory of 364 784 svchost.com 25E4A3~1.EXE PID 364 wrote to memory of 1100 364 25E4A3~1.EXE svchost.com PID 364 wrote to memory of 1100 364 25E4A3~1.EXE svchost.com PID 364 wrote to memory of 1100 364 25E4A3~1.EXE svchost.com PID 364 wrote to memory of 1100 364 25E4A3~1.EXE svchost.com PID 1100 wrote to memory of 1064 1100 svchost.com 25E4A3~1.EXE PID 1100 wrote to memory of 1064 1100 svchost.com 25E4A3~1.EXE PID 1100 wrote to memory of 1064 1100 svchost.com 25E4A3~1.EXE PID 1100 wrote to memory of 1064 1100 svchost.com 25E4A3~1.EXE PID 1064 wrote to memory of 1660 1064 25E4A3~1.EXE svchost.com PID 1064 wrote to memory of 1660 1064 25E4A3~1.EXE svchost.com PID 1064 wrote to memory of 1660 1064 25E4A3~1.EXE svchost.com PID 1064 wrote to memory of 1660 1064 25E4A3~1.EXE svchost.com PID 1660 wrote to memory of 1372 1660 svchost.com 25E4A3~1.EXE PID 1660 wrote to memory of 1372 1660 svchost.com 25E4A3~1.EXE PID 1660 wrote to memory of 1372 1660 svchost.com 25E4A3~1.EXE PID 1660 wrote to memory of 1372 1660 svchost.com 25E4A3~1.EXE PID 1372 wrote to memory of 856 1372 25E4A3~1.EXE svchost.com PID 1372 wrote to memory of 856 1372 25E4A3~1.EXE svchost.com PID 1372 wrote to memory of 856 1372 25E4A3~1.EXE svchost.com PID 1372 wrote to memory of 856 1372 25E4A3~1.EXE svchost.com PID 856 wrote to memory of 2024 856 svchost.com 25E4A3~1.EXE PID 856 wrote to memory of 2024 856 svchost.com 25E4A3~1.EXE PID 856 wrote to memory of 2024 856 svchost.com 25E4A3~1.EXE PID 856 wrote to memory of 2024 856 svchost.com 25E4A3~1.EXE PID 2024 wrote to memory of 684 2024 25E4A3~1.EXE svchost.com PID 2024 wrote to memory of 684 2024 25E4A3~1.EXE svchost.com PID 2024 wrote to memory of 684 2024 25E4A3~1.EXE svchost.com PID 2024 wrote to memory of 684 2024 25E4A3~1.EXE svchost.com PID 684 wrote to memory of 1468 684 svchost.com 25E4A3~1.EXE PID 684 wrote to memory of 1468 684 svchost.com 25E4A3~1.EXE PID 684 wrote to memory of 1468 684 svchost.com 25E4A3~1.EXE PID 684 wrote to memory of 1468 684 svchost.com 25E4A3~1.EXE PID 1468 wrote to memory of 1612 1468 25E4A3~1.EXE svchost.com PID 1468 wrote to memory of 1612 1468 25E4A3~1.EXE svchost.com PID 1468 wrote to memory of 1612 1468 25E4A3~1.EXE svchost.com PID 1468 wrote to memory of 1612 1468 25E4A3~1.EXE svchost.com PID 1612 wrote to memory of 1244 1612 svchost.com 25E4A3~1.EXE PID 1612 wrote to memory of 1244 1612 svchost.com 25E4A3~1.EXE PID 1612 wrote to memory of 1244 1612 svchost.com 25E4A3~1.EXE PID 1612 wrote to memory of 1244 1612 svchost.com 25E4A3~1.EXE PID 1244 wrote to memory of 1596 1244 25E4A3~1.EXE svchost.com PID 1244 wrote to memory of 1596 1244 25E4A3~1.EXE svchost.com PID 1244 wrote to memory of 1596 1244 25E4A3~1.EXE svchost.com PID 1244 wrote to memory of 1596 1244 25E4A3~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe"C:\Users\Admin\AppData\Local\Temp\tmp\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\25e4a379-87a3-4697-9bf3-405c7ea1233b_1013.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE18⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE20⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE22⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE24⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE26⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE28⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE30⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE32⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE34⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE36⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE38⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE40⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE42⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE44⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE46⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE48⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE50⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE52⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE54⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE56⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE58⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE60⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"61⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE62⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"63⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE64⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"65⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE66⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"67⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE68⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"69⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE70⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"71⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE72⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"73⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE74⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"75⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE76⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"77⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE78⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"79⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE80⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"81⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE82⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"83⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE84⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"85⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE86⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"87⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE88⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"89⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE90⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"91⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE92⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"93⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE94⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"95⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE96⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"97⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE98⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"99⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE100⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"101⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE102⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"103⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE104⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"105⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE106⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"107⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE108⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"109⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE110⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"111⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE112⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"113⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE114⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"115⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE116⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"117⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE118⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"119⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE120⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"121⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE122⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"123⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE124⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"125⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE126⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"127⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE128⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"129⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE130⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"131⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE132⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"133⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE134⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"135⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE136⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"137⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE138⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"139⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE140⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"141⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE142⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"143⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE144⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"145⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE146⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"147⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE148⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"149⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE150⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"151⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE152⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"153⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE154⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"155⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE156⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"157⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE158⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"159⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE160⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"161⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE162⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"163⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE164⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"165⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE166⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"167⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE168⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"169⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE170⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"171⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE172⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"173⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE174⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"175⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE176⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"177⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE178⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"179⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE180⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"181⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE182⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"183⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE184⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"185⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE186⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"187⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE188⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"189⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE190⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"191⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE192⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"193⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE194⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"195⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE196⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"197⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE198⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"199⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE200⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"201⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE202⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"203⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE204⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"205⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE206⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"207⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE208⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"209⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE210⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"211⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE212⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"213⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE214⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"215⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE216⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"217⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE218⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"219⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE220⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"221⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE222⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"223⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE224⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"225⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE226⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"227⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE228⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"229⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE230⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"231⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE232⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"233⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE234⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"235⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE236⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"237⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE238⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"239⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE240⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\25E4A3~1.EXE"241⤵