Analysis
-
max time kernel
235s -
max time network
277s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2022 23:21
Behavioral task
behavioral1
Sample
b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe
Resource
win10v2004-20221111-en
General
-
Target
b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe
-
Size
3.2MB
-
MD5
4621dbad05492f84c29d4a09ca25cc94
-
SHA1
89afb831e7388f172ae3c9de64e382e3948e75e2
-
SHA256
b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd
-
SHA512
a0388ad50c3bb872a453f42883ddd968985611b97a270d13c4fa473df30cfa481f810750d9414ad78413c9dbcf20e78475fa28e3cc174a84971d755b48def4a0
-
SSDEEP
98304:RWNAX6ZAtD8BF41nmx75v0VHlY2FRUrw8ay1eQ8zfIaRIXJpzD:yUAVV2fI8IXr
Malware Config
Signatures
-
Detect Neshta payload 35 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\3582-490\b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\odt\OFFICE~1.EXE family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe family_neshta C:\Windows\svchost.com family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exesvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.compid process 4720 b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe 1400 svchost.com 1044 B7310E~1.EXE 2420 svchost.com 4536 B7310E~1.EXE 1820 svchost.com 2328 B7310E~1.EXE 1888 svchost.com 1440 B7310E~1.EXE 4944 svchost.com 2240 B7310E~1.EXE 2176 svchost.com 1832 B7310E~1.EXE 2376 svchost.com 2756 B7310E~1.EXE 3752 svchost.com 3524 B7310E~1.EXE 2336 svchost.com 4196 B7310E~1.EXE 3812 svchost.com 4512 B7310E~1.EXE 1036 svchost.com 1952 B7310E~1.EXE 1444 svchost.com 3920 B7310E~1.EXE 4820 svchost.com 2716 B7310E~1.EXE 932 svchost.com 1256 B7310E~1.EXE 4248 svchost.com 4188 B7310E~1.EXE 1620 svchost.com 548 B7310E~1.EXE 1176 svchost.com 4064 B7310E~1.EXE 4824 svchost.com 4776 B7310E~1.EXE 4220 svchost.com 3516 B7310E~1.EXE 2528 svchost.com 1596 B7310E~1.EXE 4896 svchost.com 1516 B7310E~1.EXE 4320 svchost.com 2020 B7310E~1.EXE 3888 svchost.com 5080 B7310E~1.EXE 4324 svchost.com 3000 B7310E~1.EXE 5072 svchost.com 2656 B7310E~1.EXE 4860 svchost.com 2984 B7310E~1.EXE 4452 svchost.com 4876 B7310E~1.EXE 2848 svchost.com 1640 B7310E~1.EXE 2240 svchost.com 3764 B7310E~1.EXE 2436 svchost.com 448 B7310E~1.EXE 3328 svchost.com 3212 B7310E~1.EXE 1432 svchost.com -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
B7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEb7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exeB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEb7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exeB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation B7310E~1.EXE -
Drops file in Windows directory 64 IoCs
Processes:
B7310E~1.EXEsvchost.comsvchost.comsvchost.comB7310E~1.EXEB7310E~1.EXEsvchost.comsvchost.comsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEsvchost.comsvchost.comB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEsvchost.comB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEsvchost.comsvchost.comsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comsvchost.comB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comB7310E~1.EXEB7310E~1.EXEsvchost.comsvchost.comsvchost.comB7310E~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comB7310E~1.EXEdescription ioc process File opened for modification C:\Windows\svchost.com B7310E~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys B7310E~1.EXE File opened for modification C:\Windows\svchost.com B7310E~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys B7310E~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com B7310E~1.EXE File opened for modification C:\Windows\directx.sys B7310E~1.EXE File opened for modification C:\Windows\svchost.com B7310E~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys B7310E~1.EXE File opened for modification C:\Windows\svchost.com B7310E~1.EXE File opened for modification C:\Windows\svchost.com B7310E~1.EXE File opened for modification C:\Windows\svchost.com B7310E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com B7310E~1.EXE File opened for modification C:\Windows\directx.sys B7310E~1.EXE File opened for modification C:\Windows\directx.sys B7310E~1.EXE File opened for modification C:\Windows\directx.sys B7310E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys B7310E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys B7310E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys B7310E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys B7310E~1.EXE File opened for modification C:\Windows\directx.sys B7310E~1.EXE File opened for modification C:\Windows\svchost.com B7310E~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com B7310E~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com B7310E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys B7310E~1.EXE File opened for modification C:\Windows\directx.sys B7310E~1.EXE File opened for modification C:\Windows\directx.sys B7310E~1.EXE File opened for modification C:\Windows\svchost.com B7310E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys B7310E~1.EXE File opened for modification C:\Windows\directx.sys B7310E~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com B7310E~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys B7310E~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
Processes:
B7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEB7310E~1.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings B7310E~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exeb7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exesvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEsvchost.comB7310E~1.EXEdescription pid process target process PID 2936 wrote to memory of 4720 2936 b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe PID 2936 wrote to memory of 4720 2936 b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe PID 2936 wrote to memory of 4720 2936 b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe PID 4720 wrote to memory of 1400 4720 b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe svchost.com PID 4720 wrote to memory of 1400 4720 b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe svchost.com PID 4720 wrote to memory of 1400 4720 b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe svchost.com PID 1400 wrote to memory of 1044 1400 svchost.com B7310E~1.EXE PID 1400 wrote to memory of 1044 1400 svchost.com B7310E~1.EXE PID 1400 wrote to memory of 1044 1400 svchost.com B7310E~1.EXE PID 1044 wrote to memory of 2420 1044 B7310E~1.EXE svchost.com PID 1044 wrote to memory of 2420 1044 B7310E~1.EXE svchost.com PID 1044 wrote to memory of 2420 1044 B7310E~1.EXE svchost.com PID 2420 wrote to memory of 4536 2420 svchost.com B7310E~1.EXE PID 2420 wrote to memory of 4536 2420 svchost.com B7310E~1.EXE PID 2420 wrote to memory of 4536 2420 svchost.com B7310E~1.EXE PID 4536 wrote to memory of 1820 4536 B7310E~1.EXE svchost.com PID 4536 wrote to memory of 1820 4536 B7310E~1.EXE svchost.com PID 4536 wrote to memory of 1820 4536 B7310E~1.EXE svchost.com PID 1820 wrote to memory of 2328 1820 svchost.com B7310E~1.EXE PID 1820 wrote to memory of 2328 1820 svchost.com B7310E~1.EXE PID 1820 wrote to memory of 2328 1820 svchost.com B7310E~1.EXE PID 2328 wrote to memory of 1888 2328 B7310E~1.EXE svchost.com PID 2328 wrote to memory of 1888 2328 B7310E~1.EXE svchost.com PID 2328 wrote to memory of 1888 2328 B7310E~1.EXE svchost.com PID 1888 wrote to memory of 1440 1888 svchost.com B7310E~1.EXE PID 1888 wrote to memory of 1440 1888 svchost.com B7310E~1.EXE PID 1888 wrote to memory of 1440 1888 svchost.com B7310E~1.EXE PID 1440 wrote to memory of 4944 1440 B7310E~1.EXE svchost.com PID 1440 wrote to memory of 4944 1440 B7310E~1.EXE svchost.com PID 1440 wrote to memory of 4944 1440 B7310E~1.EXE svchost.com PID 4944 wrote to memory of 2240 4944 svchost.com B7310E~1.EXE PID 4944 wrote to memory of 2240 4944 svchost.com B7310E~1.EXE PID 4944 wrote to memory of 2240 4944 svchost.com B7310E~1.EXE PID 2240 wrote to memory of 2176 2240 B7310E~1.EXE svchost.com PID 2240 wrote to memory of 2176 2240 B7310E~1.EXE svchost.com PID 2240 wrote to memory of 2176 2240 B7310E~1.EXE svchost.com PID 2176 wrote to memory of 1832 2176 svchost.com B7310E~1.EXE PID 2176 wrote to memory of 1832 2176 svchost.com B7310E~1.EXE PID 2176 wrote to memory of 1832 2176 svchost.com B7310E~1.EXE PID 1832 wrote to memory of 2376 1832 B7310E~1.EXE svchost.com PID 1832 wrote to memory of 2376 1832 B7310E~1.EXE svchost.com PID 1832 wrote to memory of 2376 1832 B7310E~1.EXE svchost.com PID 2376 wrote to memory of 2756 2376 svchost.com B7310E~1.EXE PID 2376 wrote to memory of 2756 2376 svchost.com B7310E~1.EXE PID 2376 wrote to memory of 2756 2376 svchost.com B7310E~1.EXE PID 2756 wrote to memory of 3752 2756 B7310E~1.EXE svchost.com PID 2756 wrote to memory of 3752 2756 B7310E~1.EXE svchost.com PID 2756 wrote to memory of 3752 2756 B7310E~1.EXE svchost.com PID 3752 wrote to memory of 3524 3752 svchost.com B7310E~1.EXE PID 3752 wrote to memory of 3524 3752 svchost.com B7310E~1.EXE PID 3752 wrote to memory of 3524 3752 svchost.com B7310E~1.EXE PID 3524 wrote to memory of 2336 3524 B7310E~1.EXE svchost.com PID 3524 wrote to memory of 2336 3524 B7310E~1.EXE svchost.com PID 3524 wrote to memory of 2336 3524 B7310E~1.EXE svchost.com PID 2336 wrote to memory of 4196 2336 svchost.com B7310E~1.EXE PID 2336 wrote to memory of 4196 2336 svchost.com B7310E~1.EXE PID 2336 wrote to memory of 4196 2336 svchost.com B7310E~1.EXE PID 4196 wrote to memory of 3812 4196 B7310E~1.EXE svchost.com PID 4196 wrote to memory of 3812 4196 B7310E~1.EXE svchost.com PID 4196 wrote to memory of 3812 4196 B7310E~1.EXE svchost.com PID 3812 wrote to memory of 4512 3812 svchost.com B7310E~1.EXE PID 3812 wrote to memory of 4512 3812 svchost.com B7310E~1.EXE PID 3812 wrote to memory of 4512 3812 svchost.com B7310E~1.EXE PID 4512 wrote to memory of 1036 4512 B7310E~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe"C:\Users\Admin\AppData\Local\Temp\b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe"1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\b7310ee997506321405426fded5931da6490576668b7d818d2a16c789236affd.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE8⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE18⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"23⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE24⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"25⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE26⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"27⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE28⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"29⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE30⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"31⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE32⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"33⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE34⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"35⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE36⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"37⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE38⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"39⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE40⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"41⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE42⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"43⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE44⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"45⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE46⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"47⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE48⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"49⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE50⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"51⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE52⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"53⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE54⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"55⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE56⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"57⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE58⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"59⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE60⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"61⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE62⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"63⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE64⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"65⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE66⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"67⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE68⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"69⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE70⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"71⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE72⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"73⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE74⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"75⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE76⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"77⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE78⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"79⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE80⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"81⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE82⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"83⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE84⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"85⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE86⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"87⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE88⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"89⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE90⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"91⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE92⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"93⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE94⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"95⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE96⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"97⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE98⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"99⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE100⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"101⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE102⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"103⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE104⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"105⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE106⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"107⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE108⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"109⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE110⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"111⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE112⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"113⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE114⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"115⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE116⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"117⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE118⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"119⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE120⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"121⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE122⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"123⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE124⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"125⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE126⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"127⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE128⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"129⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE130⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"131⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE132⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"133⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE134⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"135⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE136⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"137⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE138⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"139⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE140⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"141⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE142⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"143⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE144⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"145⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE146⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"147⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE148⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"149⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE150⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"151⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE152⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"153⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE154⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"155⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE156⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"157⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE158⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"159⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE160⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"161⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE162⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"163⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE164⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"165⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE166⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"167⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE168⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"169⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE170⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"171⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE172⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"173⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE174⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"175⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE176⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"177⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE178⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"179⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE180⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"181⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE182⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"183⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE184⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"185⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE186⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"187⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE188⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"189⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE190⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"191⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE192⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"193⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE194⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"195⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE196⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"197⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE198⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"199⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE200⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"201⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE202⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"203⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE204⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"205⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE206⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"207⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE208⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"209⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE210⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"211⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE212⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"213⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE214⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"215⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE216⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"217⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE218⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"219⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE220⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"221⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE222⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"223⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE224⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"225⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE226⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"227⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE228⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"229⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE230⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"231⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE232⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"233⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE234⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"235⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE236⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"237⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE238⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"239⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE240⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7310E~1.EXE"241⤵