Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-12-2021 11:00
Static task
static1
Behavioral task
behavioral1
Sample
tmp/43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
tmp/43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe
Resource
win10-en-20211208
General
-
Target
tmp/43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe
-
Size
971KB
-
MD5
ae340c49fe80c252c79d4cd6ff796ba0
-
SHA1
96e1dc388300f396a47a2569654f64d5a0fca3e5
-
SHA256
d0735b001b2551f2f2fe2c82ca019cc262c982cda3a4625362d17f5311894c7b
-
SHA512
fdb894be585d1c3bc97c5f36e9b567e9e853e539bc6f6a9cc645d539dfb0527f736207aac8f7cc19983cfcfc1d3eb836ce6f99dc2dc82dffa4693a17b22a4027
Malware Config
Signatures
-
Detect Neshta Payload 42 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE family_neshta \Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe family_neshta C:\Windows\svchost.com family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exesvchost.exe43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exesvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.comsvchost.exe43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEpid process 1720 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe 268 svchost.exe 428 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe 812 svchost.com 1304 43AF84~1.EXE 1876 svchost.com 660 43AF84~1.EXE 1632 svchost.com 984 43AF84~1.EXE 1068 svchost.com 1724 svchost.exe 1700 43AF84~1.EXE 1244 svchost.com 1960 43AF84~1.EXE 888 svchost.com 1716 43AF84~1.EXE 1472 svchost.com 544 43AF84~1.EXE 624 svchost.com 1804 43AF84~1.EXE 1168 svchost.com 1976 43AF84~1.EXE 1508 svchost.com 1460 43AF84~1.EXE 1872 svchost.com 1620 43AF84~1.EXE 1744 svchost.com 1932 43AF84~1.EXE 1952 svchost.com 980 43AF84~1.EXE 316 svchost.com 1696 43AF84~1.EXE 1008 svchost.com 1628 43AF84~1.EXE 1704 svchost.com 1712 43AF84~1.EXE 656 svchost.com 720 43AF84~1.EXE 1452 svchost.com 1004 43AF84~1.EXE 620 svchost.com 1104 43AF84~1.EXE 1280 svchost.com 1124 43AF84~1.EXE 612 svchost.com 968 43AF84~1.EXE 952 svchost.com 1896 43AF84~1.EXE 1620 svchost.com 1728 43AF84~1.EXE 1068 svchost.com 1276 43AF84~1.EXE 1968 svchost.com 892 43AF84~1.EXE 884 svchost.com 1612 43AF84~1.EXE 1708 svchost.com 520 43AF84~1.EXE 564 svchost.com 1824 43AF84~1.EXE 1836 svchost.com 1472 43AF84~1.EXE 1304 svchost.com 1868 43AF84~1.EXE -
Loads dropped DLL 64 IoCs
Processes:
43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exesvchost.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exesvchost.comsvchost.compid process 600 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe 600 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe 268 svchost.exe 268 svchost.exe 812 svchost.com 812 svchost.com 1876 svchost.com 1876 svchost.com 1632 svchost.com 1632 svchost.com 1068 svchost.com 1068 svchost.com 1244 svchost.com 1244 svchost.com 888 svchost.com 888 svchost.com 1472 svchost.com 1472 svchost.com 624 svchost.com 624 svchost.com 1168 svchost.com 1168 svchost.com 1508 svchost.com 1508 svchost.com 1872 svchost.com 1872 svchost.com 1744 svchost.com 1744 svchost.com 1952 svchost.com 1952 svchost.com 316 svchost.com 316 svchost.com 1008 svchost.com 1008 svchost.com 1704 svchost.com 1704 svchost.com 656 svchost.com 656 svchost.com 1452 svchost.com 1452 svchost.com 620 svchost.com 620 svchost.com 1280 svchost.com 1280 svchost.com 612 svchost.com 612 svchost.com 952 svchost.com 952 svchost.com 1620 svchost.com 1620 svchost.com 1068 svchost.com 1068 svchost.com 1968 svchost.com 1968 svchost.com 884 svchost.com 884 svchost.com 1708 svchost.com 1708 svchost.com 428 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe 600 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe 564 svchost.com 564 svchost.com 1836 svchost.com 1836 svchost.com -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exedescription ioc process File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe -
Drops file in Windows directory 64 IoCs
Processes:
43AF84~1.EXE43AF84~1.EXEsvchost.comsvchost.com43AF84~1.EXE43AF84~1.EXE43AF84~1.EXE43AF84~1.EXEsvchost.com43AF84~1.EXE43AF84~1.EXEsvchost.comsvchost.comsvchost.com43AF84~1.EXE43AF84~1.EXEsvchost.comsvchost.com43AF84~1.EXEsvchost.comsvchost.comsvchost.comsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXE43AF84~1.EXE43AF84~1.EXE43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.comsvchost.comsvchost.comsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXE43AF84~1.EXE43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXE43AF84~1.EXEsvchost.comsvchost.comsvchost.com43AF84~1.EXE43AF84~1.EXE43AF84~1.EXE43AF84~1.EXE43AF84~1.EXEsvchost.comsvchost.com43AF84~1.EXE43AF84~1.EXE43AF84~1.EXE43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEdescription ioc process File opened for modification C:\Windows\svchost.com 43AF84~1.EXE File opened for modification C:\Windows\svchost.com 43AF84~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 43AF84~1.EXE File opened for modification C:\Windows\svchost.com 43AF84~1.EXE File opened for modification C:\Windows\svchost.com 43AF84~1.EXE File opened for modification C:\Windows\directx.sys 43AF84~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 43AF84~1.EXE File opened for modification C:\Windows\svchost.com 43AF84~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 43AF84~1.EXE File opened for modification C:\Windows\svchost.com 43AF84~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 43AF84~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 43AF84~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 43AF84~1.EXE File opened for modification C:\Windows\svchost.com 43AF84~1.EXE File opened for modification C:\Windows\directx.sys 43AF84~1.EXE File opened for modification C:\Windows\directx.sys 43AF84~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 43AF84~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 43AF84~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 43AF84~1.EXE File opened for modification C:\Windows\directx.sys 43AF84~1.EXE File opened for modification C:\Windows\svchost.com 43AF84~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 43AF84~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 43AF84~1.EXE File opened for modification C:\Windows\svchost.com 43AF84~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 43AF84~1.EXE File opened for modification C:\Windows\directx.sys 43AF84~1.EXE File opened for modification C:\Windows\svchost.com 43AF84~1.EXE File opened for modification C:\Windows\directx.sys 43AF84~1.EXE File opened for modification C:\Windows\directx.sys 43AF84~1.EXE File opened for modification C:\Windows\directx.sys 43AF84~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 43AF84~1.EXE File opened for modification C:\Windows\directx.sys 43AF84~1.EXE File opened for modification C:\Windows\directx.sys 43AF84~1.EXE File opened for modification C:\Windows\directx.sys 43AF84~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 43AF84~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 43AF84~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exesvchost.exe43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exesvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEsvchost.com43AF84~1.EXEdescription pid process target process PID 600 wrote to memory of 1720 600 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe PID 600 wrote to memory of 1720 600 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe PID 600 wrote to memory of 1720 600 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe PID 600 wrote to memory of 1720 600 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe PID 1720 wrote to memory of 268 1720 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe svchost.exe PID 1720 wrote to memory of 268 1720 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe svchost.exe PID 1720 wrote to memory of 268 1720 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe svchost.exe PID 1720 wrote to memory of 268 1720 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe svchost.exe PID 268 wrote to memory of 428 268 svchost.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe PID 268 wrote to memory of 428 268 svchost.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe PID 268 wrote to memory of 428 268 svchost.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe PID 268 wrote to memory of 428 268 svchost.exe 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe PID 428 wrote to memory of 812 428 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe svchost.com PID 428 wrote to memory of 812 428 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe svchost.com PID 428 wrote to memory of 812 428 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe svchost.com PID 428 wrote to memory of 812 428 43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe svchost.com PID 812 wrote to memory of 1304 812 svchost.com 43AF84~1.EXE PID 812 wrote to memory of 1304 812 svchost.com 43AF84~1.EXE PID 812 wrote to memory of 1304 812 svchost.com 43AF84~1.EXE PID 812 wrote to memory of 1304 812 svchost.com 43AF84~1.EXE PID 1304 wrote to memory of 1876 1304 43AF84~1.EXE svchost.com PID 1304 wrote to memory of 1876 1304 43AF84~1.EXE svchost.com PID 1304 wrote to memory of 1876 1304 43AF84~1.EXE svchost.com PID 1304 wrote to memory of 1876 1304 43AF84~1.EXE svchost.com PID 1876 wrote to memory of 660 1876 svchost.com 43AF84~1.EXE PID 1876 wrote to memory of 660 1876 svchost.com 43AF84~1.EXE PID 1876 wrote to memory of 660 1876 svchost.com 43AF84~1.EXE PID 1876 wrote to memory of 660 1876 svchost.com 43AF84~1.EXE PID 660 wrote to memory of 1632 660 43AF84~1.EXE svchost.com PID 660 wrote to memory of 1632 660 43AF84~1.EXE svchost.com PID 660 wrote to memory of 1632 660 43AF84~1.EXE svchost.com PID 660 wrote to memory of 1632 660 43AF84~1.EXE svchost.com PID 1632 wrote to memory of 984 1632 svchost.com 43AF84~1.EXE PID 1632 wrote to memory of 984 1632 svchost.com 43AF84~1.EXE PID 1632 wrote to memory of 984 1632 svchost.com 43AF84~1.EXE PID 1632 wrote to memory of 984 1632 svchost.com 43AF84~1.EXE PID 984 wrote to memory of 1068 984 43AF84~1.EXE svchost.com PID 984 wrote to memory of 1068 984 43AF84~1.EXE svchost.com PID 984 wrote to memory of 1068 984 43AF84~1.EXE svchost.com PID 984 wrote to memory of 1068 984 43AF84~1.EXE svchost.com PID 1068 wrote to memory of 1700 1068 svchost.com 43AF84~1.EXE PID 1068 wrote to memory of 1700 1068 svchost.com 43AF84~1.EXE PID 1068 wrote to memory of 1700 1068 svchost.com 43AF84~1.EXE PID 1068 wrote to memory of 1700 1068 svchost.com 43AF84~1.EXE PID 1700 wrote to memory of 1244 1700 43AF84~1.EXE svchost.com PID 1700 wrote to memory of 1244 1700 43AF84~1.EXE svchost.com PID 1700 wrote to memory of 1244 1700 43AF84~1.EXE svchost.com PID 1700 wrote to memory of 1244 1700 43AF84~1.EXE svchost.com PID 1244 wrote to memory of 1960 1244 svchost.com 43AF84~1.EXE PID 1244 wrote to memory of 1960 1244 svchost.com 43AF84~1.EXE PID 1244 wrote to memory of 1960 1244 svchost.com 43AF84~1.EXE PID 1244 wrote to memory of 1960 1244 svchost.com 43AF84~1.EXE PID 1960 wrote to memory of 888 1960 43AF84~1.EXE svchost.com PID 1960 wrote to memory of 888 1960 43AF84~1.EXE svchost.com PID 1960 wrote to memory of 888 1960 43AF84~1.EXE svchost.com PID 1960 wrote to memory of 888 1960 43AF84~1.EXE svchost.com PID 888 wrote to memory of 1716 888 svchost.com 43AF84~1.EXE PID 888 wrote to memory of 1716 888 svchost.com 43AF84~1.EXE PID 888 wrote to memory of 1716 888 svchost.com 43AF84~1.EXE PID 888 wrote to memory of 1716 888 svchost.com 43AF84~1.EXE PID 1716 wrote to memory of 1472 1716 43AF84~1.EXE svchost.com PID 1716 wrote to memory of 1472 1716 43AF84~1.EXE svchost.com PID 1716 wrote to memory of 1472 1716 43AF84~1.EXE svchost.com PID 1716 wrote to memory of 1472 1716 43AF84~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe"C:\Users\Admin\AppData\Local\Temp\tmp\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\43af84b9-9366-4084-a1b1-d74d4bc5d31f_1015.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE12⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE18⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE20⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE22⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE24⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE26⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE28⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE30⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE32⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE34⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE36⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE38⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE40⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE42⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE44⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE46⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE48⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE50⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE52⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE54⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE56⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE58⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE60⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"61⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE62⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"63⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE64⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"65⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE66⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"67⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE68⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"69⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE70⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"71⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE72⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"73⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE74⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"75⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE76⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"77⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE78⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"79⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE80⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"81⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE82⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"83⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE84⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"85⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE86⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"87⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE88⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"89⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE90⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"91⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE92⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"93⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE94⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"95⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE96⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"97⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE98⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"99⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE100⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"101⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE102⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"103⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE104⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"105⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE106⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"107⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE108⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"109⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE110⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"111⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE112⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"113⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE114⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"115⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE116⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"117⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE118⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"119⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE120⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"121⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE122⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"123⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE124⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"125⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE126⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"127⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE128⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"129⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE130⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"131⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE132⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"133⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE134⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"135⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE136⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"137⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE138⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"139⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE140⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"141⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE142⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"143⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE144⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"145⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE146⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"147⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE148⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"149⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE150⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"151⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE152⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"153⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE154⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"155⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE156⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"157⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE158⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"159⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE160⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"161⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE162⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"163⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE164⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"165⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE166⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"167⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE168⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"169⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE170⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"171⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE172⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"173⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE174⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"175⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE176⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"177⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE178⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"179⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE180⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"181⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE182⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"183⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE184⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"185⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE186⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"187⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE188⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"189⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE190⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"191⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE192⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"193⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE194⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"195⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE196⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"197⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE198⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"199⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE200⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"201⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE202⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"203⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE204⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"205⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE206⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"207⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE208⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"209⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE210⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"211⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE212⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"213⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE214⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"215⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE216⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"217⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE218⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"219⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE220⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"221⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE222⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"223⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE224⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"225⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE226⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"227⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE228⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"229⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE230⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"231⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE232⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"233⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE234⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"235⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE236⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"237⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE238⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"239⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE240⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\43AF84~1.EXE"241⤵