Analysis
-
max time kernel
173s -
max time network
171s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 01:18
Static task
static1
Behavioral task
behavioral1
Sample
af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe
Resource
win10-en-20211208
General
-
Target
af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe
-
Size
247KB
-
MD5
d19dd26e8431e2bf91a977e6cbda25ae
-
SHA1
5632744a3749814de3964a505091ab368ad1b20b
-
SHA256
af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8
-
SHA512
1d9b09edb34c1c68024279ab3487b17cf67e2e395cd8a109ff3c1e2d23dadf96c163431019542e58755f294a2dae593b6fb3c7f1b88eca2007629e40dff8d358
Malware Config
Signatures
-
Detect Neshta Payload 35 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\3582-490\af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\odt\OFFICE~1.EXE family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE family_neshta C:\Windows\svchost.com family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Executes dropped EXE 64 IoCs
Processes:
af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exesvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.compid process 4060 af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe 4220 svchost.com 4256 AF47F8~1.EXE 4212 svchost.com 4368 AF47F8~1.EXE 4388 svchost.com 4316 AF47F8~1.EXE 3280 svchost.com 3880 AF47F8~1.EXE 3704 svchost.com 3352 AF47F8~1.EXE 672 svchost.com 764 AF47F8~1.EXE 1068 svchost.com 1232 AF47F8~1.EXE 1448 svchost.com 1624 AF47F8~1.EXE 1876 svchost.com 2056 AF47F8~1.EXE 2340 svchost.com 2564 AF47F8~1.EXE 2660 svchost.com 2692 AF47F8~1.EXE 3964 svchost.com 3164 AF47F8~1.EXE 4816 svchost.com 1312 AF47F8~1.EXE 1892 svchost.com 2956 AF47F8~1.EXE 4900 svchost.com 4544 AF47F8~1.EXE 3932 svchost.com 3152 AF47F8~1.EXE 4880 svchost.com 5048 AF47F8~1.EXE 2604 svchost.com 5040 AF47F8~1.EXE 1088 svchost.com 600 AF47F8~1.EXE 732 svchost.com 2436 AF47F8~1.EXE 4988 svchost.com 356 AF47F8~1.EXE 688 svchost.com 1252 AF47F8~1.EXE 4508 svchost.com 4500 AF47F8~1.EXE 1420 svchost.com 2296 AF47F8~1.EXE 2260 svchost.com 1860 AF47F8~1.EXE 1948 svchost.com 2024 AF47F8~1.EXE 4440 svchost.com 2236 AF47F8~1.EXE 4164 svchost.com 2904 AF47F8~1.EXE 3004 svchost.com 4000 AF47F8~1.EXE 3916 svchost.com 3788 AF47F8~1.EXE 3920 svchost.com 3776 AF47F8~1.EXE 3124 svchost.com -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exeaf47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exedescription ioc process File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\WINDOW~2\WinMail.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe -
Drops file in Windows directory 64 IoCs
Processes:
svchost.comAF47F8~1.EXEAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comsvchost.comAF47F8~1.EXEAF47F8~1.EXEsvchost.comAF47F8~1.EXEAF47F8~1.EXEsvchost.comAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEsvchost.comsvchost.comAF47F8~1.EXEsvchost.comsvchost.comAF47F8~1.EXEAF47F8~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comsvchost.comsvchost.comAF47F8~1.EXEAF47F8~1.EXEsvchost.comAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEsvchost.comsvchost.comsvchost.comAF47F8~1.EXEdescription ioc process File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com AF47F8~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com AF47F8~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com AF47F8~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com AF47F8~1.EXE File opened for modification C:\Windows\svchost.com AF47F8~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com AF47F8~1.EXE File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com AF47F8~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com AF47F8~1.EXE File opened for modification C:\Windows\directx.sys AF47F8~1.EXE File opened for modification C:\Windows\directx.sys AF47F8~1.EXE File opened for modification C:\Windows\directx.sys AF47F8~1.EXE File opened for modification C:\Windows\directx.sys AF47F8~1.EXE File opened for modification C:\Windows\directx.sys AF47F8~1.EXE File opened for modification C:\Windows\directx.sys AF47F8~1.EXE File opened for modification C:\Windows\directx.sys AF47F8~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys AF47F8~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys AF47F8~1.EXE File opened for modification C:\Windows\directx.sys AF47F8~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com AF47F8~1.EXE File opened for modification C:\Windows\svchost.com AF47F8~1.EXE File opened for modification C:\Windows\directx.sys AF47F8~1.EXE File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com AF47F8~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys AF47F8~1.EXE File opened for modification C:\Windows\directx.sys AF47F8~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys AF47F8~1.EXE File opened for modification C:\Windows\directx.sys AF47F8~1.EXE File opened for modification C:\Windows\directx.sys AF47F8~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com AF47F8~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
Processes:
AF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEAF47F8~1.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings AF47F8~1.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exeaf47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exesvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEsvchost.comAF47F8~1.EXEdescription pid process target process PID 496 wrote to memory of 4060 496 af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe PID 496 wrote to memory of 4060 496 af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe PID 496 wrote to memory of 4060 496 af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe PID 4060 wrote to memory of 4220 4060 af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe svchost.com PID 4060 wrote to memory of 4220 4060 af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe svchost.com PID 4060 wrote to memory of 4220 4060 af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe svchost.com PID 4220 wrote to memory of 4256 4220 svchost.com AF47F8~1.EXE PID 4220 wrote to memory of 4256 4220 svchost.com AF47F8~1.EXE PID 4220 wrote to memory of 4256 4220 svchost.com AF47F8~1.EXE PID 4256 wrote to memory of 4212 4256 AF47F8~1.EXE svchost.com PID 4256 wrote to memory of 4212 4256 AF47F8~1.EXE svchost.com PID 4256 wrote to memory of 4212 4256 AF47F8~1.EXE svchost.com PID 4212 wrote to memory of 4368 4212 svchost.com AF47F8~1.EXE PID 4212 wrote to memory of 4368 4212 svchost.com AF47F8~1.EXE PID 4212 wrote to memory of 4368 4212 svchost.com AF47F8~1.EXE PID 4368 wrote to memory of 4388 4368 AF47F8~1.EXE svchost.com PID 4368 wrote to memory of 4388 4368 AF47F8~1.EXE svchost.com PID 4368 wrote to memory of 4388 4368 AF47F8~1.EXE svchost.com PID 4388 wrote to memory of 4316 4388 svchost.com AF47F8~1.EXE PID 4388 wrote to memory of 4316 4388 svchost.com AF47F8~1.EXE PID 4388 wrote to memory of 4316 4388 svchost.com AF47F8~1.EXE PID 4316 wrote to memory of 3280 4316 AF47F8~1.EXE svchost.com PID 4316 wrote to memory of 3280 4316 AF47F8~1.EXE svchost.com PID 4316 wrote to memory of 3280 4316 AF47F8~1.EXE svchost.com PID 3280 wrote to memory of 3880 3280 svchost.com AF47F8~1.EXE PID 3280 wrote to memory of 3880 3280 svchost.com AF47F8~1.EXE PID 3280 wrote to memory of 3880 3280 svchost.com AF47F8~1.EXE PID 3880 wrote to memory of 3704 3880 AF47F8~1.EXE svchost.com PID 3880 wrote to memory of 3704 3880 AF47F8~1.EXE svchost.com PID 3880 wrote to memory of 3704 3880 AF47F8~1.EXE svchost.com PID 3704 wrote to memory of 3352 3704 svchost.com AF47F8~1.EXE PID 3704 wrote to memory of 3352 3704 svchost.com AF47F8~1.EXE PID 3704 wrote to memory of 3352 3704 svchost.com AF47F8~1.EXE PID 3352 wrote to memory of 672 3352 AF47F8~1.EXE svchost.com PID 3352 wrote to memory of 672 3352 AF47F8~1.EXE svchost.com PID 3352 wrote to memory of 672 3352 AF47F8~1.EXE svchost.com PID 672 wrote to memory of 764 672 svchost.com AF47F8~1.EXE PID 672 wrote to memory of 764 672 svchost.com AF47F8~1.EXE PID 672 wrote to memory of 764 672 svchost.com AF47F8~1.EXE PID 764 wrote to memory of 1068 764 AF47F8~1.EXE svchost.com PID 764 wrote to memory of 1068 764 AF47F8~1.EXE svchost.com PID 764 wrote to memory of 1068 764 AF47F8~1.EXE svchost.com PID 1068 wrote to memory of 1232 1068 svchost.com AF47F8~1.EXE PID 1068 wrote to memory of 1232 1068 svchost.com AF47F8~1.EXE PID 1068 wrote to memory of 1232 1068 svchost.com AF47F8~1.EXE PID 1232 wrote to memory of 1448 1232 AF47F8~1.EXE svchost.com PID 1232 wrote to memory of 1448 1232 AF47F8~1.EXE svchost.com PID 1232 wrote to memory of 1448 1232 AF47F8~1.EXE svchost.com PID 1448 wrote to memory of 1624 1448 svchost.com AF47F8~1.EXE PID 1448 wrote to memory of 1624 1448 svchost.com AF47F8~1.EXE PID 1448 wrote to memory of 1624 1448 svchost.com AF47F8~1.EXE PID 1624 wrote to memory of 1876 1624 AF47F8~1.EXE svchost.com PID 1624 wrote to memory of 1876 1624 AF47F8~1.EXE svchost.com PID 1624 wrote to memory of 1876 1624 AF47F8~1.EXE svchost.com PID 1876 wrote to memory of 2056 1876 svchost.com AF47F8~1.EXE PID 1876 wrote to memory of 2056 1876 svchost.com AF47F8~1.EXE PID 1876 wrote to memory of 2056 1876 svchost.com AF47F8~1.EXE PID 2056 wrote to memory of 2340 2056 AF47F8~1.EXE svchost.com PID 2056 wrote to memory of 2340 2056 AF47F8~1.EXE svchost.com PID 2056 wrote to memory of 2340 2056 AF47F8~1.EXE svchost.com PID 2340 wrote to memory of 2564 2340 svchost.com AF47F8~1.EXE PID 2340 wrote to memory of 2564 2340 svchost.com AF47F8~1.EXE PID 2340 wrote to memory of 2564 2340 svchost.com AF47F8~1.EXE PID 2564 wrote to memory of 2660 2564 AF47F8~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe"C:\Users\Admin\AppData\Local\Temp\af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\af47f867ba8d67380321101fe6fb6a4bb087e8bd22ad3bf8989c5dee667740a8.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE6⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"23⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE24⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"25⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE1⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE3⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE5⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE7⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE9⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE11⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"12⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE13⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"14⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE15⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"16⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE17⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"18⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE19⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"20⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE21⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"22⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE23⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"24⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE25⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"26⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE27⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"28⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE29⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"30⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE31⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"32⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE33⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"34⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE35⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"36⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE37⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"38⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE39⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"40⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE41⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"42⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE43⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"44⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE45⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"46⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE47⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"48⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE49⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"50⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE51⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"52⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE53⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"54⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE55⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"56⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE57⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"58⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE59⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"60⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE61⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"62⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE63⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"64⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE65⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"66⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE67⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"68⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE69⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"70⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE71⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"72⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE1⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE3⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"4⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE5⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"6⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE7⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"8⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE9⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"10⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE11⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"12⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE13⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"14⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE15⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"16⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE17⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"18⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE19⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"20⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE21⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"22⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE23⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"24⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE25⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"26⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE27⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"28⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE29⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"30⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE31⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"32⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE33⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"34⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE35⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"36⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE37⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"38⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE39⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"40⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE41⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"42⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE43⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"44⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE45⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"46⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE47⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"48⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE49⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"50⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE51⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"52⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE53⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"54⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE55⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"56⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE57⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"58⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE59⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"60⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE61⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"62⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE63⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"64⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE65⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"66⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE67⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"68⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE69⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"70⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE71⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"72⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE73⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"74⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE75⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"76⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE77⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"78⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE79⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"80⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE81⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"82⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE83⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"84⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE85⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"86⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE87⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"88⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE89⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"90⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE91⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"92⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE93⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"94⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE95⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"96⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE97⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"98⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE99⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"100⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE101⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"102⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE103⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"104⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE105⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"106⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE107⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"108⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE109⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"110⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE111⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"112⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE113⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"114⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE115⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"116⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE117⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"118⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE119⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"120⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE121⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"122⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE123⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"124⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE125⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"126⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE127⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"128⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE129⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"130⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE131⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"132⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE133⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"134⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE135⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"136⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE137⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"138⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE139⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"140⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE141⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"142⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE143⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"144⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE145⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"146⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE147⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"148⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE149⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"150⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE151⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"152⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE153⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"154⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE155⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"156⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE157⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"158⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE159⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"160⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE161⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"162⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE163⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"164⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE165⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"166⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE167⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"168⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE169⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"170⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE171⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"172⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE173⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"174⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE175⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"176⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE177⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"178⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE179⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"180⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE181⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"182⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE183⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"184⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE185⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"186⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE187⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"188⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE189⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"190⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE191⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"192⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE193⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"194⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE195⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"196⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE197⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"198⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE199⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"200⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE201⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"202⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE131⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"132⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE133⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"134⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE135⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"136⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE137⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"138⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE139⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"140⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE141⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"142⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE143⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"144⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE145⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"146⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE147⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"148⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE149⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"150⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE151⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"152⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE153⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"154⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE155⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"156⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE157⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"158⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE159⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"160⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE161⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"162⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE163⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"164⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE165⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"166⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE167⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"168⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE169⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"170⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE171⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"172⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE173⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"174⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE175⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"176⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE177⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"178⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE179⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"180⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE181⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"182⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE183⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"184⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE185⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"186⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE187⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"188⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE189⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"190⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE191⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"192⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE193⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"194⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE195⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"196⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE197⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"198⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE199⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"200⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE201⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"202⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE203⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"204⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE205⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"206⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE207⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"208⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE209⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"210⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE211⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"212⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE213⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"214⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE215⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"216⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE217⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"218⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE219⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"220⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE221⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"222⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE223⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"224⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE225⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"226⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE227⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"228⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE229⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"230⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE231⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"232⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE233⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"234⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE235⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"236⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE237⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"238⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE239⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE"240⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AF47F8~1.EXE241⤵
- Modifies registry class