Analysis
-
max time kernel
146s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 12:30
Behavioral task
behavioral1
Sample
2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe
Resource
win7-20240221-en
General
-
Target
2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe
-
Size
217KB
-
MD5
2219802df8a09e0ce53ddf7dc5fde337
-
SHA1
ad7c0b0bf751f5cf10cf4f541f78b4a6e4981080
-
SHA256
5ebf9f85b062b4e0417fad150002e55b7563af040dcde97834c76ed827745188
-
SHA512
268720b30db5885920f6b5a667bf167b72b3f3acc15ab426b86296ea1a2627df302dc19d85768298b1c35a0e5eb9d320722fa3cd17be3159a1bed0f2374ea898
-
SSDEEP
3072:sr85Ct2M+lmsolAIrRuw+mqv9j1MWLQy5qMjvAFs9xfOMHr85Ct:k9tV+lDAAtos9z9t
Malware Config
Extracted
xworm
5.0
45.138.16.245:3232
0UFV4aMOGjS4dAoi
-
Install_directory
%AppData%
-
install_file
updater.exe
-
telegram
https://api.telegram.org/bot6540672623:AAGukZDFGHruAlAUrHlj3x5shLqUsP0iku8/sendMessage?chat_id=6300910507
Signatures
-
Detect Neshta payload 64 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\3582-490\2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe family_neshta C:\Windows\svchost.com family_neshta behavioral2/memory/2004-16-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4536-20-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3168-28-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4088-32-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2672-40-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2264-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2324-52-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4244-56-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4992-64-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4964-68-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2736-76-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4648-87-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1356-88-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4552-99-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3668-100-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe family_neshta behavioral2/memory/1844-111-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE family_neshta behavioral2/memory/2380-132-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4508-136-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/404-144-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4216-148-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3124-156-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4896-176-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE family_neshta C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe family_neshta C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe family_neshta C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe family_neshta C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE family_neshta C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE family_neshta C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE family_neshta C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE family_neshta C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE family_neshta C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE family_neshta C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe family_neshta C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe family_neshta behavioral2/memory/1256-240-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/224-247-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1672-260-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4608-267-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/5000-272-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1072-279-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4956-285-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2316-287-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2000-293-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4432-295-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2820-301-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4500-303-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/5108-309-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3972-311-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4648-317-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4416-324-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1144-325-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4552-332-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1636-333-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3100-335-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1788-341-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1776-343-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1868-349-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1876-354-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2140-357-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Detect Xworm Payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\3582-490\2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe family_xworm behavioral2/memory/1692-1473-0x00000000008E0000-0x0000000000908000-memory.dmp family_xworm C:\Users\Admin\AppData\Roaming\updater.exe family_xworm -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Detects Windows executables referencing non-Windows User-Agents 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\3582-490\2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/1692-1473-0x00000000008E0000-0x0000000000908000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA C:\Users\Admin\AppData\Roaming\updater.exe INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects executables using Telegram Chat Bot 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\3582-490\2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe INDICATOR_SUSPICIOUS_EXE_TelegramChatBot behavioral2/memory/1692-1473-0x00000000008E0000-0x0000000000908000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TelegramChatBot C:\Users\Admin\AppData\Roaming\updater.exe INDICATOR_SUSPICIOUS_EXE_TelegramChatBot -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXEdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-0~1.EXE -
Drops startup file 2 IoCs
Processes:
2024-0~1.EXEdescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\updater.lnk 2024-0~1.EXE File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\updater.lnk 2024-0~1.EXE -
Executes dropped EXE 64 IoCs
Processes:
2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exesvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.compid process 2964 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe 2004 svchost.com 4536 2024-0~1.EXE 3168 svchost.com 4088 2024-0~1.EXE 2672 svchost.com 2264 2024-0~1.EXE 2324 svchost.com 4244 2024-0~1.EXE 4992 svchost.com 4964 2024-0~1.EXE 2736 svchost.com 4648 2024-0~1.EXE 1356 svchost.com 4552 2024-0~1.EXE 3668 svchost.com 1844 2024-0~1.EXE 2380 svchost.com 4508 2024-0~1.EXE 404 svchost.com 4216 2024-0~1.EXE 3124 svchost.com 4896 2024-0~1.EXE 1256 svchost.com 224 2024-0~1.EXE 1672 svchost.com 4608 2024-0~1.EXE 5000 svchost.com 1072 2024-0~1.EXE 4956 svchost.com 2316 2024-0~1.EXE 2000 svchost.com 4432 2024-0~1.EXE 2820 svchost.com 4500 2024-0~1.EXE 5108 svchost.com 3972 2024-0~1.EXE 4648 svchost.com 4416 2024-0~1.EXE 1144 svchost.com 4552 2024-0~1.EXE 1636 svchost.com 3100 2024-0~1.EXE 1788 svchost.com 1776 2024-0~1.EXE 1868 svchost.com 1876 2024-0~1.EXE 2140 svchost.com 1428 2024-0~1.EXE 4844 svchost.com 2772 2024-0~1.EXE 3476 svchost.com 4564 2024-0~1.EXE 2516 svchost.com 4492 2024-0~1.EXE 716 svchost.com 2576 2024-0~1.EXE 744 svchost.com 1700 2024-0~1.EXE 2600 svchost.com 1092 2024-0~1.EXE 2672 svchost.com 2128 2024-0~1.EXE 1072 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exedescription ioc process File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~2.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13187~1.37\MICROS~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MI391D~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13187~1.37\MICROS~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MIA062~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~4.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MIA062~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe -
Drops file in Windows directory 64 IoCs
Processes:
svchost.comsvchost.comsvchost.com2024-0~1.EXEsvchost.comsvchost.comsvchost.com2024-0~1.EXE2024-0~1.EXE2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.comsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXE2024-0~1.EXE2024-0~1.EXEsvchost.com2024-0~1.EXE2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXE2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXE2024-0~1.EXEsvchost.com2024-0~1.EXE2024-0~1.EXE2024-0~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com2024-0~1.EXEsvchost.comsvchost.com2024-0~1.EXE2024-0~1.EXEsvchost.com2024-0~1.EXE2024-0~1.EXE2024-0~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com2024-0~1.EXEsvchost.comdescription ioc process File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2024-0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2024-0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
Processes:
2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXE2024-0~1.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2024-0~1.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2024-0~1.EXEpid process 1692 2024-0~1.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2024-0~1.EXEdescription pid process Token: SeDebugPrivilege 1692 2024-0~1.EXE Token: SeDebugPrivilege 1692 2024-0~1.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
2024-0~1.EXEpid process 1692 2024-0~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exesvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEsvchost.com2024-0~1.EXEdescription pid process target process PID 1968 wrote to memory of 2964 1968 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe PID 1968 wrote to memory of 2964 1968 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe PID 1968 wrote to memory of 2964 1968 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe PID 2964 wrote to memory of 2004 2964 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe svchost.com PID 2964 wrote to memory of 2004 2964 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe svchost.com PID 2964 wrote to memory of 2004 2964 2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe svchost.com PID 2004 wrote to memory of 4536 2004 svchost.com 2024-0~1.EXE PID 2004 wrote to memory of 4536 2004 svchost.com 2024-0~1.EXE PID 2004 wrote to memory of 4536 2004 svchost.com 2024-0~1.EXE PID 4536 wrote to memory of 3168 4536 2024-0~1.EXE svchost.com PID 4536 wrote to memory of 3168 4536 2024-0~1.EXE svchost.com PID 4536 wrote to memory of 3168 4536 2024-0~1.EXE svchost.com PID 3168 wrote to memory of 4088 3168 svchost.com 2024-0~1.EXE PID 3168 wrote to memory of 4088 3168 svchost.com 2024-0~1.EXE PID 3168 wrote to memory of 4088 3168 svchost.com 2024-0~1.EXE PID 4088 wrote to memory of 2672 4088 2024-0~1.EXE svchost.com PID 4088 wrote to memory of 2672 4088 2024-0~1.EXE svchost.com PID 4088 wrote to memory of 2672 4088 2024-0~1.EXE svchost.com PID 2672 wrote to memory of 2264 2672 svchost.com 2024-0~1.EXE PID 2672 wrote to memory of 2264 2672 svchost.com 2024-0~1.EXE PID 2672 wrote to memory of 2264 2672 svchost.com 2024-0~1.EXE PID 2264 wrote to memory of 2324 2264 2024-0~1.EXE svchost.com PID 2264 wrote to memory of 2324 2264 2024-0~1.EXE svchost.com PID 2264 wrote to memory of 2324 2264 2024-0~1.EXE svchost.com PID 2324 wrote to memory of 4244 2324 svchost.com 2024-0~1.EXE PID 2324 wrote to memory of 4244 2324 svchost.com 2024-0~1.EXE PID 2324 wrote to memory of 4244 2324 svchost.com 2024-0~1.EXE PID 4244 wrote to memory of 4992 4244 2024-0~1.EXE svchost.com PID 4244 wrote to memory of 4992 4244 2024-0~1.EXE svchost.com PID 4244 wrote to memory of 4992 4244 2024-0~1.EXE svchost.com PID 4992 wrote to memory of 4964 4992 svchost.com 2024-0~1.EXE PID 4992 wrote to memory of 4964 4992 svchost.com 2024-0~1.EXE PID 4992 wrote to memory of 4964 4992 svchost.com 2024-0~1.EXE PID 4964 wrote to memory of 2736 4964 2024-0~1.EXE svchost.com PID 4964 wrote to memory of 2736 4964 2024-0~1.EXE svchost.com PID 4964 wrote to memory of 2736 4964 2024-0~1.EXE svchost.com PID 2736 wrote to memory of 4648 2736 svchost.com svchost.com PID 2736 wrote to memory of 4648 2736 svchost.com svchost.com PID 2736 wrote to memory of 4648 2736 svchost.com svchost.com PID 4648 wrote to memory of 1356 4648 2024-0~1.EXE svchost.com PID 4648 wrote to memory of 1356 4648 2024-0~1.EXE svchost.com PID 4648 wrote to memory of 1356 4648 2024-0~1.EXE svchost.com PID 1356 wrote to memory of 4552 1356 svchost.com 2024-0~1.EXE PID 1356 wrote to memory of 4552 1356 svchost.com 2024-0~1.EXE PID 1356 wrote to memory of 4552 1356 svchost.com 2024-0~1.EXE PID 4552 wrote to memory of 3668 4552 2024-0~1.EXE svchost.com PID 4552 wrote to memory of 3668 4552 2024-0~1.EXE svchost.com PID 4552 wrote to memory of 3668 4552 2024-0~1.EXE svchost.com PID 3668 wrote to memory of 1844 3668 svchost.com 2024-0~1.EXE PID 3668 wrote to memory of 1844 3668 svchost.com 2024-0~1.EXE PID 3668 wrote to memory of 1844 3668 svchost.com 2024-0~1.EXE PID 1844 wrote to memory of 2380 1844 2024-0~1.EXE svchost.com PID 1844 wrote to memory of 2380 1844 2024-0~1.EXE svchost.com PID 1844 wrote to memory of 2380 1844 2024-0~1.EXE svchost.com PID 2380 wrote to memory of 4508 2380 svchost.com 2024-0~1.EXE PID 2380 wrote to memory of 4508 2380 svchost.com 2024-0~1.EXE PID 2380 wrote to memory of 4508 2380 svchost.com 2024-0~1.EXE PID 4508 wrote to memory of 404 4508 2024-0~1.EXE svchost.com PID 4508 wrote to memory of 404 4508 2024-0~1.EXE svchost.com PID 4508 wrote to memory of 404 4508 2024-0~1.EXE svchost.com PID 404 wrote to memory of 4216 404 svchost.com 2024-0~1.EXE PID 404 wrote to memory of 4216 404 svchost.com 2024-0~1.EXE PID 404 wrote to memory of 4216 404 svchost.com 2024-0~1.EXE PID 4216 wrote to memory of 3124 4216 2024-0~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\2024-05-22_2219802df8a09e0ce53ddf7dc5fde337_hiddentear_neshta.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE14⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"23⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE24⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"25⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE26⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"27⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE28⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"29⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE30⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"31⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE32⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"33⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE34⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"35⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE36⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"37⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE38⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"39⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE40⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"41⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE42⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"43⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE44⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"45⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE46⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"47⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE48⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"49⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE50⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"51⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE52⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"53⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE54⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"55⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE56⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"57⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE58⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"59⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE60⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"61⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE62⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"63⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE64⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"65⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE66⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"67⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE68⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"69⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE70⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"71⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE72⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"73⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE74⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"75⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE76⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"77⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE78⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"79⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE80⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"81⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE82⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"83⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE84⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"85⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE86⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"87⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE88⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"89⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE90⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"91⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE92⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"93⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE94⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"95⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE96⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"97⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE98⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"99⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE100⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"101⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE102⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"103⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE104⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"105⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE106⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"107⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE108⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"109⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE110⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"111⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE112⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"113⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE114⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"115⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE116⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"117⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE118⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"119⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE120⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"121⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE122⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"123⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE124⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"125⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE126⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"127⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE128⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"129⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE130⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"131⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE132⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"133⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE134⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"135⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE136⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"137⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE138⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"139⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE140⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"141⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE142⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"143⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE144⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"145⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE146⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"147⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE148⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"149⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE150⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"151⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE152⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"153⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE154⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"155⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE156⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"157⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE158⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"159⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE160⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"161⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE162⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"163⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE164⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"165⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE166⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"167⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE168⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"169⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE170⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"171⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE172⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"173⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE174⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"175⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE176⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"177⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE178⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"179⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE180⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"181⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE182⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"183⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE184⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"185⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE186⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"187⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE188⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"189⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE190⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"191⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE192⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"193⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE194⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"195⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE196⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"197⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE198⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"199⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE200⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"201⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE202⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"203⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE204⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"205⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE206⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"207⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE208⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"209⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE210⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"211⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE212⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"213⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE214⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"215⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE216⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"217⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE218⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"219⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE220⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"221⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE222⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"223⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE224⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"225⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE226⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"227⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE228⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"229⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE230⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"231⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE232⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"233⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE234⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"235⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE236⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"237⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE238⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"239⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE240⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2024-0~1.EXE"241⤵