Analysis
-
max time kernel
76s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02-12-2022 14:41
Behavioral task
behavioral1
Sample
7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe
Resource
win10v2004-20221111-en
General
-
Target
7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe
-
Size
829KB
-
MD5
027e5d553aad71df1b213e1f3736d540
-
SHA1
9e5816cfae9ae0685dae5ceee87f90ee28c7c826
-
SHA256
7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c
-
SHA512
a4137d1eef4a7c51e6e80afaea76d4d7fa4c0636d7fa1e41ed9a7cdace8e8df0012ea5585500fd0a699c803f4b8ccc41ef8fd8c6cf101b0ac66e001100a681a7
-
SSDEEP
12288:BUo8xhMoYe3aGeoaGeoaGeoaGeoaGeoaGeoaGeoa:KoEh1YYaGjaGjaGjaGjaGjaGjaGja
Malware Config
Signatures
-
Detect Neshta payload 45 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta C:\Windows\svchost.com family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta C:\Windows\svchost.com family_neshta \Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta C:\Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta \Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe family_neshta C:\Windows\svchost.com family_neshta C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exesvchost.exe7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exesvchost.exesvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.comsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXE7F6E29~1.EXE7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEpid process 840 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe 1736 svchost.exe 276 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe 1132 svchost.exe 1144 svchost.com 1716 7F6E29~1.EXE 460 svchost.com 1012 7F6E29~1.EXE 1592 svchost.com 2016 7F6E29~1.EXE 1644 svchost.com 1996 7F6E29~1.EXE 876 svchost.com 436 7F6E29~1.EXE 1124 svchost.com 1892 7F6E29~1.EXE 1612 svchost.com 2044 7F6E29~1.EXE 1464 svchost.com 1736 7F6E29~1.EXE 1408 svchost.com 1580 7F6E29~1.EXE 288 svchost.com 1284 7F6E29~1.EXE 460 svchost.com 1012 7F6E29~1.EXE 1576 svchost.com 1660 7F6E29~1.EXE 2008 svchost.com 772 7F6E29~1.EXE 1980 svchost.com 1996 7F6E29~1.EXE 1664 svchost.com 1428 7F6E29~1.EXE 1000 svchost.com 1772 7F6E29~1.EXE 1668 svchost.com 1728 7F6E29~1.EXE 916 svchost.com 1088 7F6E29~1.EXE 1524 svchost.com 584 7F6E29~1.EXE 1464 svchost.com 1940 7F6E29~1.EXE 1520 svchost.com 1732 7F6E29~1.EXE 1044 svchost.com 1432 7F6E29~1.EXE 988 svchost.com 1344 7F6E29~1.EXE 1012 svchost.com 1972 7F6E29~1.EXE 1660 svchost.com 1492 7F6E29~1.EXE 1392 svchost.com 1420 7F6E29~1.EXE 1692 7F6E29~1.EXE 1844 7F6E29~1.EXE 1648 svchost.com 1324 7F6E29~1.EXE 1772 svchost.com 2004 7F6E29~1.EXE 1668 svchost.com 1988 7F6E29~1.EXE -
Loads dropped DLL 64 IoCs
Processes:
7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exesvchost.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com7F6E29~1.EXEpid process 1204 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe 1204 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe 1736 svchost.exe 1736 svchost.exe 1144 svchost.com 1144 svchost.com 460 svchost.com 460 svchost.com 1592 svchost.com 1592 svchost.com 1644 svchost.com 1644 svchost.com 876 svchost.com 876 svchost.com 1124 svchost.com 1124 svchost.com 1612 svchost.com 1612 svchost.com 1464 svchost.com 1464 svchost.com 1408 svchost.com 1408 svchost.com 1204 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe 276 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe 1204 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe 288 svchost.com 288 svchost.com 1204 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe 460 svchost.com 460 svchost.com 1576 svchost.com 1576 svchost.com 2008 svchost.com 2008 svchost.com 1980 svchost.com 1980 svchost.com 1664 svchost.com 1664 svchost.com 1000 svchost.com 1000 svchost.com 1668 svchost.com 1668 svchost.com 916 svchost.com 916 svchost.com 1524 svchost.com 1524 svchost.com 1464 svchost.com 1464 svchost.com 1520 svchost.com 1520 svchost.com 1204 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe 1044 svchost.com 1044 svchost.com 988 svchost.com 988 svchost.com 1204 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe 1012 svchost.com 1012 svchost.com 1660 svchost.com 1660 svchost.com 276 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe 1392 svchost.com 1392 svchost.com 1692 7F6E29~1.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exedescription ioc process File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe -
Drops file in Windows directory 64 IoCs
Processes:
svchost.com7F6E29~1.EXE7F6E29~1.EXEsvchost.com7F6E29~1.EXE7F6E29~1.EXEsvchost.comsvchost.com7F6E29~1.EXE7F6E29~1.EXEsvchost.comsvchost.com7F6E29~1.EXEsvchost.exesvchost.comsvchost.comsvchost.comsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXE7F6E29~1.EXEsvchost.comsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.comsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXE7F6E29~1.EXE7F6E29~1.EXE7F6E29~1.EXE7F6E29~1.EXE7F6E29~1.EXE7F6E29~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com7F6E29~1.EXE7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.comsvchost.comsvchost.comsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.comdescription ioc process File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 7F6E29~1.EXE File opened for modification C:\Windows\directx.sys 7F6E29~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 7F6E29~1.EXE File opened for modification C:\Windows\svchost.com 7F6E29~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 7F6E29~1.EXE File opened for modification C:\Windows\directx.sys 7F6E29~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 7F6E29~1.EXE File opened for modification C:\Windows\svchost.com svchost.exe File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 7F6E29~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 7F6E29~1.EXE File opened for modification C:\Windows\directx.sys 7F6E29~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 7F6E29~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 7F6E29~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 7F6E29~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 7F6E29~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 7F6E29~1.EXE File opened for modification C:\Windows\directx.sys 7F6E29~1.EXE File opened for modification C:\Windows\directx.sys 7F6E29~1.EXE File opened for modification C:\Windows\svchost.com 7F6E29~1.EXE File opened for modification C:\Windows\directx.sys 7F6E29~1.EXE File opened for modification C:\Windows\svchost.com 7F6E29~1.EXE File opened for modification C:\Windows\svchost.com 7F6E29~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 7F6E29~1.EXE File opened for modification C:\Windows\directx.sys 7F6E29~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 7F6E29~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 7F6E29~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 7F6E29~1.EXE File opened for modification C:\Windows\directx.sys svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exesvchost.exe7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exesvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEsvchost.com7F6E29~1.EXEdescription pid process target process PID 1204 wrote to memory of 840 1204 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe PID 1204 wrote to memory of 840 1204 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe PID 1204 wrote to memory of 840 1204 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe PID 1204 wrote to memory of 840 1204 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe PID 840 wrote to memory of 1736 840 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe svchost.exe PID 840 wrote to memory of 1736 840 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe svchost.exe PID 840 wrote to memory of 1736 840 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe svchost.exe PID 840 wrote to memory of 1736 840 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe svchost.exe PID 1736 wrote to memory of 276 1736 svchost.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe PID 1736 wrote to memory of 276 1736 svchost.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe PID 1736 wrote to memory of 276 1736 svchost.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe PID 1736 wrote to memory of 276 1736 svchost.exe 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe PID 276 wrote to memory of 1144 276 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe svchost.com PID 276 wrote to memory of 1144 276 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe svchost.com PID 276 wrote to memory of 1144 276 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe svchost.com PID 276 wrote to memory of 1144 276 7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe svchost.com PID 1144 wrote to memory of 1716 1144 svchost.com 7F6E29~1.EXE PID 1144 wrote to memory of 1716 1144 svchost.com 7F6E29~1.EXE PID 1144 wrote to memory of 1716 1144 svchost.com 7F6E29~1.EXE PID 1144 wrote to memory of 1716 1144 svchost.com 7F6E29~1.EXE PID 1716 wrote to memory of 460 1716 7F6E29~1.EXE svchost.com PID 1716 wrote to memory of 460 1716 7F6E29~1.EXE svchost.com PID 1716 wrote to memory of 460 1716 7F6E29~1.EXE svchost.com PID 1716 wrote to memory of 460 1716 7F6E29~1.EXE svchost.com PID 460 wrote to memory of 1012 460 svchost.com 7F6E29~1.EXE PID 460 wrote to memory of 1012 460 svchost.com 7F6E29~1.EXE PID 460 wrote to memory of 1012 460 svchost.com 7F6E29~1.EXE PID 460 wrote to memory of 1012 460 svchost.com 7F6E29~1.EXE PID 1012 wrote to memory of 1592 1012 7F6E29~1.EXE svchost.com PID 1012 wrote to memory of 1592 1012 7F6E29~1.EXE svchost.com PID 1012 wrote to memory of 1592 1012 7F6E29~1.EXE svchost.com PID 1012 wrote to memory of 1592 1012 7F6E29~1.EXE svchost.com PID 1592 wrote to memory of 2016 1592 svchost.com 7F6E29~1.EXE PID 1592 wrote to memory of 2016 1592 svchost.com 7F6E29~1.EXE PID 1592 wrote to memory of 2016 1592 svchost.com 7F6E29~1.EXE PID 1592 wrote to memory of 2016 1592 svchost.com 7F6E29~1.EXE PID 2016 wrote to memory of 1644 2016 7F6E29~1.EXE svchost.com PID 2016 wrote to memory of 1644 2016 7F6E29~1.EXE svchost.com PID 2016 wrote to memory of 1644 2016 7F6E29~1.EXE svchost.com PID 2016 wrote to memory of 1644 2016 7F6E29~1.EXE svchost.com PID 1644 wrote to memory of 1996 1644 svchost.com 7F6E29~1.EXE PID 1644 wrote to memory of 1996 1644 svchost.com 7F6E29~1.EXE PID 1644 wrote to memory of 1996 1644 svchost.com 7F6E29~1.EXE PID 1644 wrote to memory of 1996 1644 svchost.com 7F6E29~1.EXE PID 1996 wrote to memory of 876 1996 7F6E29~1.EXE svchost.com PID 1996 wrote to memory of 876 1996 7F6E29~1.EXE svchost.com PID 1996 wrote to memory of 876 1996 7F6E29~1.EXE svchost.com PID 1996 wrote to memory of 876 1996 7F6E29~1.EXE svchost.com PID 876 wrote to memory of 436 876 svchost.com 7F6E29~1.EXE PID 876 wrote to memory of 436 876 svchost.com 7F6E29~1.EXE PID 876 wrote to memory of 436 876 svchost.com 7F6E29~1.EXE PID 876 wrote to memory of 436 876 svchost.com 7F6E29~1.EXE PID 436 wrote to memory of 1124 436 7F6E29~1.EXE svchost.com PID 436 wrote to memory of 1124 436 7F6E29~1.EXE svchost.com PID 436 wrote to memory of 1124 436 7F6E29~1.EXE svchost.com PID 436 wrote to memory of 1124 436 7F6E29~1.EXE svchost.com PID 1124 wrote to memory of 1892 1124 svchost.com 7F6E29~1.EXE PID 1124 wrote to memory of 1892 1124 svchost.com 7F6E29~1.EXE PID 1124 wrote to memory of 1892 1124 svchost.com 7F6E29~1.EXE PID 1124 wrote to memory of 1892 1124 svchost.com 7F6E29~1.EXE PID 1892 wrote to memory of 1612 1892 7F6E29~1.EXE svchost.com PID 1892 wrote to memory of 1612 1892 7F6E29~1.EXE svchost.com PID 1892 wrote to memory of 1612 1892 7F6E29~1.EXE svchost.com PID 1892 wrote to memory of 1612 1892 7F6E29~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe"C:\Users\Admin\AppData\Local\Temp\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\7f6e29a854d4f1f3f6f19dcb1126273c37f4224dfe3bf06a24631fbee7a2cf8c.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"7⤵
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE1⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE2⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE2⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE4⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE6⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE8⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE12⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE14⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE18⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE20⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE22⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE24⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE26⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE28⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE30⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE32⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE34⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE36⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE38⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE40⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"41⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE42⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"43⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE44⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"45⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE46⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"47⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE48⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"49⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE50⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"51⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE52⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"53⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE54⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"55⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE56⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"57⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE58⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"59⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE60⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"61⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE62⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"63⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE64⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"65⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE66⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"67⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE68⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"69⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE70⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"71⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE72⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"73⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE74⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"75⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE76⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"77⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE78⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"79⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE80⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"81⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE82⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"83⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE84⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"85⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE86⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"87⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE88⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"89⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE90⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"91⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE92⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"93⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE94⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"95⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE96⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"97⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE98⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"99⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE100⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"101⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE102⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"103⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE104⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"105⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE106⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"107⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE108⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"109⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE110⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"111⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE112⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"113⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE114⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"115⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE116⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"117⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE118⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"119⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE120⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"121⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE122⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"123⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE124⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"125⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE126⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"127⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE128⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"129⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE130⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"131⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE132⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"133⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE134⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"135⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE136⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"137⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE138⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"139⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE140⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"141⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE142⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"143⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE144⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"145⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE146⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"147⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE148⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"149⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE150⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"151⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE152⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"153⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE154⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"155⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE156⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"157⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE158⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"159⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE160⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"161⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE162⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"163⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE164⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"165⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE166⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"167⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE168⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"169⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE170⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"171⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE172⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"173⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE174⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"175⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE176⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"177⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE178⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"179⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE180⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"181⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE182⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"183⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE184⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"185⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE186⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"187⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE188⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"189⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE190⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"191⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE192⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"193⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE194⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"195⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE196⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"197⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE198⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"199⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE200⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"201⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE202⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"203⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE204⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"205⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE206⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"207⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE208⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"209⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE210⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"211⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE212⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"213⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE214⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"215⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE216⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"217⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE218⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"219⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE220⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"221⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE222⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"223⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE224⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"225⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE226⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"227⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE228⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"229⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE230⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"231⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE232⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"233⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE234⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"235⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE236⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"237⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE238⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"239⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE240⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7F6E29~1.EXE"241⤵