Analysis
-
max time kernel
130s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 12:30
Behavioral task
behavioral1
Sample
2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe
Resource
win7-20240221-en
General
-
Target
2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe
-
Size
217KB
-
MD5
2219802df8a09e0ce53ddf7dc5fde337
-
SHA1
ad7c0b0bf751f5cf10cf4f541f78b4a6e4981080
-
SHA256
5ebf9f85b062b4e0417fad150002e55b7563af040dcde97834c76ed827745188
-
SHA512
268720b30db5885920f6b5a667bf167b72b3f3acc15ab426b86296ea1a2627df302dc19d85768298b1c35a0e5eb9d320722fa3cd17be3159a1bed0f2374ea898
-
SSDEEP
3072:sr85Ct2M+lmsolAIrRuw+mqv9j1MWLQy5qMjvAFs9xfOMHr85Ct:k9tV+lDAAtos9z9t
Malware Config
Extracted
xworm
5.0
45.138.16.245:3232
0UFV4aMOGjS4dAoi
-
Install_directory
%AppData%
-
install_file
updater.exe
-
telegram
https://api.telegram.org/bot6540672623:AAGukZDFGHruAlAUrHlj3x5shLqUsP0iku8/sendMessage?chat_id=6300910507
Signatures
-
Detect Neshta payload 64 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3582-490\2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe family_neshta C:\Windows\svchost.com family_neshta C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe family_neshta behavioral1/memory/2460-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2584-29-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2332-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1984-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2568-52-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2592-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2964-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2140-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1476-87-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2104-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1496-101-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/380-100-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/620-114-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/324-115-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1320-127-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1780-128-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2732-142-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3056-149-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2312-152-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1732-151-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1464-159-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/656-160-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3016-173-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2228-172-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/964-197-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2852-198-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/240-217-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2040-225-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2004-233-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/848-232-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1668-250-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1248-249-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2532-268-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1200-267-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2584-291-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2788-294-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2508-317-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2380-316-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1548-328-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/772-329-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/768-337-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2064-336-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2100-358-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2084-359-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/328-369-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2308-368-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1436-372-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1684-371-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1780-380-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2656-379-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2632-388-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3068-387-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1076-396-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2512-395-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1696-404-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2052-403-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2268-412-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2980-411-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Detect Xworm Payload 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3582-490\2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe family_xworm behavioral1/memory/2948-1837-0x0000000000340000-0x0000000000368000-memory.dmp family_xworm C:\Users\Admin\AppData\Roaming\updater.exe family_xworm -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Detects Windows executables referencing non-Windows User-Agents 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3582-490\2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2948-1837-0x0000000000340000-0x0000000000368000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA C:\Users\Admin\AppData\Roaming\updater.exe INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects executables using Telegram Chat Bot 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3582-490\2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe INDICATOR_SUSPICIOUS_EXE_TelegramChatBot behavioral1/memory/2948-1837-0x0000000000340000-0x0000000000368000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TelegramChatBot C:\Users\Admin\AppData\Roaming\updater.exe INDICATOR_SUSPICIOUS_EXE_TelegramChatBot -
Drops startup file 2 IoCs
Processes:
2024-0~1.EXEdescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\updater.lnk 2024-0~1.EXE File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\updater.lnk 2024-0~1.EXE -
Executes dropped EXE 64 IoCs
Processes:
2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exesvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.compid process 2424 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe 2584 svchost.com 2460 2024-0~1.EXE 2592 svchost.com 2568 2024-0~1.EXE 2332 svchost.com 1984 2024-0~1.EXE 2964 svchost.com 2140 2024-0~1.EXE 1476 svchost.com 2104 2024-0~1.EXE 1496 svchost.com 380 2024-0~1.EXE 620 svchost.com 324 2024-0~1.EXE 1780 svchost.com 1320 2024-0~1.EXE 2732 svchost.com 3056 2024-0~1.EXE 2312 svchost.com 1732 2024-0~1.EXE 656 svchost.com 1464 2024-0~1.EXE 3016 svchost.com 2228 2024-0~1.EXE 2852 svchost.com 964 2024-0~1.EXE 240 svchost.com 2040 2024-0~1.EXE 2004 svchost.com 848 2024-0~1.EXE 1668 svchost.com 1248 2024-0~1.EXE 1200 svchost.com 2532 2024-0~1.EXE 2584 svchost.com 2788 2024-0~1.EXE 2508 svchost.com 2380 2024-0~1.EXE 772 svchost.com 1548 2024-0~1.EXE 768 svchost.com 2064 2024-0~1.EXE 2100 svchost.com 2084 2024-0~1.EXE 328 svchost.com 2308 2024-0~1.EXE 1436 svchost.com 1684 2024-0~1.EXE 1780 svchost.com 2656 2024-0~1.EXE 2632 svchost.com 3068 2024-0~1.EXE 1076 svchost.com 2512 2024-0~1.EXE 1696 svchost.com 2052 2024-0~1.EXE 2268 svchost.com 2980 2024-0~1.EXE 1852 svchost.com 1516 2024-0~1.EXE 844 svchost.com 1788 2024-0~1.EXE 1740 svchost.com -
Loads dropped DLL 64 IoCs
Processes:
2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.compid process 2664 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe 2664 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe 2584 svchost.com 2584 svchost.com 2592 svchost.com 2592 svchost.com 2332 svchost.com 2332 svchost.com 2964 svchost.com 2964 svchost.com 1476 svchost.com 1476 svchost.com 1496 svchost.com 1496 svchost.com 620 svchost.com 620 svchost.com 1780 svchost.com 1780 svchost.com 2732 svchost.com 2732 svchost.com 2312 svchost.com 2312 svchost.com 656 svchost.com 656 svchost.com 3016 svchost.com 3016 svchost.com 2424 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe 2852 svchost.com 2852 svchost.com 2664 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe 240 svchost.com 240 svchost.com 2004 svchost.com 2004 svchost.com 1668 svchost.com 1668 svchost.com 2424 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe 1200 svchost.com 1200 svchost.com 2424 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe 2584 svchost.com 2584 svchost.com 2508 svchost.com 2508 svchost.com 772 svchost.com 772 svchost.com 768 svchost.com 768 svchost.com 2100 svchost.com 2100 svchost.com 328 svchost.com 328 svchost.com 1436 svchost.com 1436 svchost.com 1780 svchost.com 1780 svchost.com 2632 svchost.com 2632 svchost.com 1076 svchost.com 1076 svchost.com 1696 svchost.com 1696 svchost.com 2268 svchost.com 2268 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exedescription ioc process File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe -
Drops file in Windows directory 64 IoCs
Processes:
2024-0~1.EXEsvchost.comsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXE2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXE2024-0~1.EXEsvchost.comsvchost.comsvchost.com2024-0~1.EXEsvchost.comsvchost.comsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXE2024-0~1.EXEsvchost.comsvchost.com2024-0~1.EXE2024-0~1.EXEsvchost.comsvchost.com2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXEsvchost.comsvchost.com2024-0~1.EXEsvchost.comsvchost.com2024-0~1.EXE2024-0~1.EXEsvchost.com2024-0~1.EXE2024-0~1.EXEsvchost.comsvchost.com2024-0~1.EXEsvchost.comsvchost.comsvchost.com2024-0~1.EXEsvchost.comsvchost.comsvchost.com2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXEsvchost.comsvchost.comsvchost.com2024-0~1.EXEsvchost.comdescription ioc process File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2024-0~1.EXEpid process 2948 2024-0~1.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2024-0~1.EXEdescription pid process Token: SeDebugPrivilege 2948 2024-0~1.EXE Token: SeDebugPrivilege 2948 2024-0~1.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
2024-0~1.EXEpid process 2948 2024-0~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exesvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEdescription pid process target process PID 2664 wrote to memory of 2424 2664 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe PID 2664 wrote to memory of 2424 2664 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe PID 2664 wrote to memory of 2424 2664 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe PID 2664 wrote to memory of 2424 2664 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe PID 2424 wrote to memory of 2584 2424 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe svchost.com PID 2424 wrote to memory of 2584 2424 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe svchost.com PID 2424 wrote to memory of 2584 2424 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe svchost.com PID 2424 wrote to memory of 2584 2424 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe svchost.com PID 2584 wrote to memory of 2460 2584 svchost.com 2024-0~1.EXE PID 2584 wrote to memory of 2460 2584 svchost.com 2024-0~1.EXE PID 2584 wrote to memory of 2460 2584 svchost.com 2024-0~1.EXE PID 2584 wrote to memory of 2460 2584 svchost.com 2024-0~1.EXE PID 2460 wrote to memory of 2592 2460 2024-0~1.EXE svchost.com PID 2460 wrote to memory of 2592 2460 2024-0~1.EXE svchost.com PID 2460 wrote to memory of 2592 2460 2024-0~1.EXE svchost.com PID 2460 wrote to memory of 2592 2460 2024-0~1.EXE svchost.com PID 2592 wrote to memory of 2568 2592 svchost.com 2024-0~1.EXE PID 2592 wrote to memory of 2568 2592 svchost.com 2024-0~1.EXE PID 2592 wrote to memory of 2568 2592 svchost.com 2024-0~1.EXE PID 2592 wrote to memory of 2568 2592 svchost.com 2024-0~1.EXE PID 2568 wrote to memory of 2332 2568 2024-0~1.EXE svchost.com PID 2568 wrote to memory of 2332 2568 2024-0~1.EXE svchost.com PID 2568 wrote to memory of 2332 2568 2024-0~1.EXE svchost.com PID 2568 wrote to memory of 2332 2568 2024-0~1.EXE svchost.com PID 2332 wrote to memory of 1984 2332 svchost.com 2024-0~1.EXE PID 2332 wrote to memory of 1984 2332 svchost.com 2024-0~1.EXE PID 2332 wrote to memory of 1984 2332 svchost.com 2024-0~1.EXE PID 2332 wrote to memory of 1984 2332 svchost.com 2024-0~1.EXE PID 1984 wrote to memory of 2964 1984 2024-0~1.EXE svchost.com PID 1984 wrote to memory of 2964 1984 2024-0~1.EXE svchost.com PID 1984 wrote to memory of 2964 1984 2024-0~1.EXE svchost.com PID 1984 wrote to memory of 2964 1984 2024-0~1.EXE svchost.com PID 2964 wrote to memory of 2140 2964 svchost.com 2024-0~1.EXE PID 2964 wrote to memory of 2140 2964 svchost.com 2024-0~1.EXE PID 2964 wrote to memory of 2140 2964 svchost.com 2024-0~1.EXE PID 2964 wrote to memory of 2140 2964 svchost.com 2024-0~1.EXE PID 2140 wrote to memory of 1476 2140 2024-0~1.EXE svchost.com PID 2140 wrote to memory of 1476 2140 2024-0~1.EXE svchost.com PID 2140 wrote to memory of 1476 2140 2024-0~1.EXE svchost.com PID 2140 wrote to memory of 1476 2140 2024-0~1.EXE svchost.com PID 1476 wrote to memory of 2104 1476 svchost.com 2024-0~1.EXE PID 1476 wrote to memory of 2104 1476 svchost.com 2024-0~1.EXE PID 1476 wrote to memory of 2104 1476 svchost.com 2024-0~1.EXE PID 1476 wrote to memory of 2104 1476 svchost.com 2024-0~1.EXE PID 2104 wrote to memory of 1496 2104 2024-0~1.EXE svchost.com PID 2104 wrote to memory of 1496 2104 2024-0~1.EXE svchost.com PID 2104 wrote to memory of 1496 2104 2024-0~1.EXE svchost.com PID 2104 wrote to memory of 1496 2104 2024-0~1.EXE svchost.com PID 1496 wrote to memory of 380 1496 svchost.com 2024-0~1.EXE PID 1496 wrote to memory of 380 1496 svchost.com 2024-0~1.EXE PID 1496 wrote to memory of 380 1496 svchost.com 2024-0~1.EXE PID 1496 wrote to memory of 380 1496 svchost.com 2024-0~1.EXE PID 380 wrote to memory of 620 380 2024-0~1.EXE svchost.com PID 380 wrote to memory of 620 380 2024-0~1.EXE svchost.com PID 380 wrote to memory of 620 380 2024-0~1.EXE svchost.com PID 380 wrote to memory of 620 380 2024-0~1.EXE svchost.com PID 620 wrote to memory of 324 620 svchost.com 2024-0~1.EXE PID 620 wrote to memory of 324 620 svchost.com 2024-0~1.EXE PID 620 wrote to memory of 324 620 svchost.com 2024-0~1.EXE PID 620 wrote to memory of 324 620 svchost.com 2024-0~1.EXE PID 324 wrote to memory of 1780 324 2024-0~1.EXE svchost.com PID 324 wrote to memory of 1780 324 2024-0~1.EXE svchost.com PID 324 wrote to memory of 1780 324 2024-0~1.EXE svchost.com PID 324 wrote to memory of 1780 324 2024-0~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE18⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE20⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE22⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE24⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE26⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE28⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE30⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE32⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE34⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE36⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE38⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE40⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE42⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE44⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE46⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE48⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE50⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE52⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE54⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE56⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE58⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE60⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"61⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE62⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"63⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE64⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"65⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE66⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"67⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE68⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"69⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE70⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"71⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE72⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"73⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE74⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"75⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE76⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"77⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE78⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"79⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE80⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"81⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE82⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"83⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE84⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"85⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE86⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"87⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE88⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"89⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE90⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"91⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE92⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"93⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE94⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"95⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE96⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"97⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE98⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"99⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE100⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"101⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE102⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"103⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE104⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"105⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE106⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"107⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE108⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"109⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE110⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"111⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE112⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"113⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE114⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"115⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE116⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"117⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE118⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"119⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE120⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"121⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE122⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"123⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE124⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"125⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE126⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"127⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE128⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"129⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE130⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"131⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE132⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"133⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE134⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"135⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE136⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"137⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE138⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"139⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE140⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"141⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE142⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"143⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE144⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"145⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE146⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"147⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE148⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"149⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE150⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"151⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE152⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"153⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE154⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"155⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE156⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"157⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE158⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"159⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE160⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"161⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE162⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"163⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE164⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"165⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE166⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"167⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE168⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"169⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE170⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"171⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE172⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"173⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE174⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"175⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE176⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"177⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE178⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"179⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE180⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"181⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE182⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"183⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE184⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"185⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE186⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"187⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE188⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"189⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE190⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"191⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE192⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"193⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE194⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"195⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE196⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"197⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE198⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"199⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE200⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"201⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE202⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"203⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE204⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"205⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE206⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"207⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE208⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"209⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE210⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"211⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE212⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"213⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE214⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"215⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE216⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"217⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE218⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"219⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE220⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"221⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE222⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"223⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE224⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"225⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE226⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"227⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE228⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"229⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE230⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"231⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE232⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"233⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE234⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"235⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE236⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"237⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE238⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"239⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE240⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"241⤵