Analysis
-
max time kernel
122s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 19:25
Behavioral task
behavioral1
Sample
202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe
Resource
win7-20240221-en
General
-
Target
202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe
-
Size
217KB
-
MD5
2219802df8a09e0ce53ddf7dc5fde337
-
SHA1
ad7c0b0bf751f5cf10cf4f541f78b4a6e4981080
-
SHA256
5ebf9f85b062b4e0417fad150002e55b7563af040dcde97834c76ed827745188
-
SHA512
268720b30db5885920f6b5a667bf167b72b3f3acc15ab426b86296ea1a2627df302dc19d85768298b1c35a0e5eb9d320722fa3cd17be3159a1bed0f2374ea898
-
SSDEEP
3072:sr85Ct2M+lmsolAIrRuw+mqv9j1MWLQy5qMjvAFs9xfOMHr85Ct:k9tV+lDAAtos9z9t
Malware Config
Extracted
xworm
5.0
45.138.16.245:3232
0UFV4aMOGjS4dAoi
-
Install_directory
%AppData%
-
install_file
updater.exe
-
telegram
https://api.telegram.org/bot6540672623:AAGukZDFGHruAlAUrHlj3x5shLqUsP0iku8/sendMessage?chat_id=6300910507
Signatures
-
Detect Neshta payload 64 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3582-490\202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe family_neshta C:\Windows\svchost.com family_neshta C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe family_neshta behavioral1/memory/2588-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2540-29-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2396-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2568-43-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1708-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2404-57-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2504-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2868-71-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1564-87-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1348-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2624-101-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1476-99-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE family_neshta behavioral1/memory/1516-122-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2320-121-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE family_neshta C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE family_neshta C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe family_neshta behavioral1/memory/2040-142-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/376-143-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/696-158-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1904-159-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1416-177-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1784-176-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/644-188-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1244-191-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2372-202-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1080-203-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1792-213-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1468-214-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/276-231-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/884-230-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2804-257-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2220-258-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1664-275-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2228-274-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2616-290-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2488-291-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2412-298-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2096-299-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2400-306-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2576-307-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2404-315-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2420-314-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1716-322-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2144-323-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2868-331-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/632-330-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2692-338-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2376-339-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1456-346-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1552-347-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1584-354-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2132-355-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2688-363-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2280-362-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2028-370-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2696-371-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Detect Xworm Payload 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3582-490\202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe family_xworm behavioral1/memory/348-1978-0x0000000000020000-0x0000000000048000-memory.dmp family_xworm C:\Users\Admin\AppData\Roaming\updater.exe family_xworm -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Drops startup file 2 IoCs
Processes:
202405~1.EXEdescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\updater.lnk 202405~1.EXE File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\updater.lnk 202405~1.EXE -
Executes dropped EXE 64 IoCs
Processes:
202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exesvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.compid process 1880 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe 2588 svchost.com 2540 202405~1.EXE 2396 svchost.com 2568 202405~1.EXE 1708 svchost.com 2404 202405~1.EXE 2504 svchost.com 2868 202405~1.EXE 1564 svchost.com 1348 202405~1.EXE 2624 svchost.com 1476 202405~1.EXE 1516 svchost.com 2320 202405~1.EXE 376 svchost.com 2040 202405~1.EXE 1904 svchost.com 696 202405~1.EXE 1416 svchost.com 1784 202405~1.EXE 644 svchost.com 1244 202405~1.EXE 1080 svchost.com 2372 202405~1.EXE 1468 svchost.com 1792 202405~1.EXE 276 svchost.com 884 202405~1.EXE 2220 svchost.com 2804 202405~1.EXE 1664 svchost.com 2228 202405~1.EXE 2488 svchost.com 2616 202405~1.EXE 2096 svchost.com 2412 202405~1.EXE 2576 svchost.com 2400 202405~1.EXE 2420 svchost.com 2404 202405~1.EXE 2144 svchost.com 1716 202405~1.EXE 2868 svchost.com 632 202405~1.EXE 2376 svchost.com 2692 202405~1.EXE 1552 svchost.com 1456 202405~1.EXE 2132 svchost.com 1584 202405~1.EXE 2688 svchost.com 2280 202405~1.EXE 2696 svchost.com 2028 202405~1.EXE 2016 svchost.com 2040 202405~1.EXE 536 svchost.com 1408 202405~1.EXE 1904 svchost.com 2700 202405~1.EXE 576 svchost.com 584 202405~1.EXE 1772 svchost.com -
Loads dropped DLL 64 IoCs
Processes:
202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.compid process 1900 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe 1900 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe 2588 svchost.com 2588 svchost.com 2396 svchost.com 2396 svchost.com 1708 svchost.com 1708 svchost.com 2504 svchost.com 2504 svchost.com 1564 svchost.com 1564 svchost.com 2624 svchost.com 2624 svchost.com 1516 svchost.com 1516 svchost.com 1880 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe 1900 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe 376 svchost.com 376 svchost.com 1904 svchost.com 1904 svchost.com 1416 svchost.com 1416 svchost.com 644 svchost.com 644 svchost.com 1080 svchost.com 1080 svchost.com 1468 svchost.com 1468 svchost.com 276 svchost.com 276 svchost.com 2220 svchost.com 2220 svchost.com 1880 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe 1664 svchost.com 1664 svchost.com 1900 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe 2488 svchost.com 2488 svchost.com 1900 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe 2096 svchost.com 2096 svchost.com 2576 svchost.com 2576 svchost.com 2420 svchost.com 2420 svchost.com 2144 svchost.com 2144 svchost.com 2868 svchost.com 2868 svchost.com 2376 svchost.com 2376 svchost.com 1552 svchost.com 1552 svchost.com 2132 svchost.com 2132 svchost.com 2688 svchost.com 2688 svchost.com 2696 svchost.com 2696 svchost.com 2016 svchost.com 2016 svchost.com 536 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exedescription ioc process File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe -
Drops file in Windows directory 64 IoCs
Processes:
svchost.com202405~1.EXE202405~1.EXE202405~1.EXE202405~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com202405~1.EXEsvchost.comsvchost.comsvchost.comsvchost.com202405~1.EXE202405~1.EXE202405~1.EXE202405~1.EXEsvchost.comsvchost.com202405~1.EXEsvchost.comsvchost.com202405~1.EXE202405~1.EXE202405~1.EXEsvchost.com202405~1.EXE202405~1.EXEsvchost.comsvchost.com202405~1.EXE202405~1.EXEsvchost.com202405~1.EXE202405~1.EXEsvchost.com202405~1.EXE202405~1.EXE202405~1.EXEsvchost.comsvchost.comsvchost.com202405~1.EXEsvchost.com202405~1.EXE202405~1.EXE202405~1.EXE202405~1.EXE202405~1.EXEsvchost.comsvchost.com202405~1.EXEsvchost.com202405~1.EXE202405~1.EXE202405~1.EXEsvchost.comsvchost.comdescription ioc process File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 202405~1.EXE File opened for modification C:\Windows\svchost.com 202405~1.EXE File opened for modification C:\Windows\svchost.com 202405~1.EXE File opened for modification C:\Windows\directx.sys 202405~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 202405~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 202405~1.EXE File opened for modification C:\Windows\svchost.com 202405~1.EXE File opened for modification C:\Windows\svchost.com 202405~1.EXE File opened for modification C:\Windows\svchost.com 202405~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 202405~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 202405~1.EXE File opened for modification C:\Windows\directx.sys 202405~1.EXE File opened for modification C:\Windows\svchost.com 202405~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 202405~1.EXE File opened for modification C:\Windows\directx.sys 202405~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 202405~1.EXE File opened for modification C:\Windows\directx.sys 202405~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 202405~1.EXE File opened for modification C:\Windows\svchost.com 202405~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 202405~1.EXE File opened for modification C:\Windows\svchost.com 202405~1.EXE File opened for modification C:\Windows\svchost.com 202405~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 202405~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 202405~1.EXE File opened for modification C:\Windows\directx.sys 202405~1.EXE File opened for modification C:\Windows\svchost.com 202405~1.EXE File opened for modification C:\Windows\svchost.com 202405~1.EXE File opened for modification C:\Windows\svchost.com 202405~1.EXE File opened for modification C:\Windows\svchost.com 202405~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 202405~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 202405~1.EXE File opened for modification C:\Windows\directx.sys 202405~1.EXE File opened for modification C:\Windows\directx.sys 202405~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
202405~1.EXEpid process 348 202405~1.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
202405~1.EXEdescription pid process Token: SeDebugPrivilege 348 202405~1.EXE Token: SeDebugPrivilege 348 202405~1.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
202405~1.EXEpid process 348 202405~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exesvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEsvchost.com202405~1.EXEdescription pid process target process PID 1900 wrote to memory of 1880 1900 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe PID 1900 wrote to memory of 1880 1900 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe PID 1900 wrote to memory of 1880 1900 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe PID 1900 wrote to memory of 1880 1900 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe PID 1880 wrote to memory of 2588 1880 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe svchost.com PID 1880 wrote to memory of 2588 1880 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe svchost.com PID 1880 wrote to memory of 2588 1880 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe svchost.com PID 1880 wrote to memory of 2588 1880 202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe svchost.com PID 2588 wrote to memory of 2540 2588 svchost.com 202405~1.EXE PID 2588 wrote to memory of 2540 2588 svchost.com 202405~1.EXE PID 2588 wrote to memory of 2540 2588 svchost.com 202405~1.EXE PID 2588 wrote to memory of 2540 2588 svchost.com 202405~1.EXE PID 2540 wrote to memory of 2396 2540 202405~1.EXE svchost.com PID 2540 wrote to memory of 2396 2540 202405~1.EXE svchost.com PID 2540 wrote to memory of 2396 2540 202405~1.EXE svchost.com PID 2540 wrote to memory of 2396 2540 202405~1.EXE svchost.com PID 2396 wrote to memory of 2568 2396 svchost.com 202405~1.EXE PID 2396 wrote to memory of 2568 2396 svchost.com 202405~1.EXE PID 2396 wrote to memory of 2568 2396 svchost.com 202405~1.EXE PID 2396 wrote to memory of 2568 2396 svchost.com 202405~1.EXE PID 2568 wrote to memory of 1708 2568 202405~1.EXE svchost.com PID 2568 wrote to memory of 1708 2568 202405~1.EXE svchost.com PID 2568 wrote to memory of 1708 2568 202405~1.EXE svchost.com PID 2568 wrote to memory of 1708 2568 202405~1.EXE svchost.com PID 1708 wrote to memory of 2404 1708 svchost.com 202405~1.EXE PID 1708 wrote to memory of 2404 1708 svchost.com 202405~1.EXE PID 1708 wrote to memory of 2404 1708 svchost.com 202405~1.EXE PID 1708 wrote to memory of 2404 1708 svchost.com 202405~1.EXE PID 2404 wrote to memory of 2504 2404 202405~1.EXE svchost.com PID 2404 wrote to memory of 2504 2404 202405~1.EXE svchost.com PID 2404 wrote to memory of 2504 2404 202405~1.EXE svchost.com PID 2404 wrote to memory of 2504 2404 202405~1.EXE svchost.com PID 2504 wrote to memory of 2868 2504 svchost.com svchost.com PID 2504 wrote to memory of 2868 2504 svchost.com svchost.com PID 2504 wrote to memory of 2868 2504 svchost.com svchost.com PID 2504 wrote to memory of 2868 2504 svchost.com svchost.com PID 2868 wrote to memory of 1564 2868 202405~1.EXE svchost.com PID 2868 wrote to memory of 1564 2868 202405~1.EXE svchost.com PID 2868 wrote to memory of 1564 2868 202405~1.EXE svchost.com PID 2868 wrote to memory of 1564 2868 202405~1.EXE svchost.com PID 1564 wrote to memory of 1348 1564 svchost.com 202405~1.EXE PID 1564 wrote to memory of 1348 1564 svchost.com 202405~1.EXE PID 1564 wrote to memory of 1348 1564 svchost.com 202405~1.EXE PID 1564 wrote to memory of 1348 1564 svchost.com 202405~1.EXE PID 1348 wrote to memory of 2624 1348 202405~1.EXE svchost.com PID 1348 wrote to memory of 2624 1348 202405~1.EXE svchost.com PID 1348 wrote to memory of 2624 1348 202405~1.EXE svchost.com PID 1348 wrote to memory of 2624 1348 202405~1.EXE svchost.com PID 2624 wrote to memory of 1476 2624 svchost.com 202405~1.EXE PID 2624 wrote to memory of 1476 2624 svchost.com 202405~1.EXE PID 2624 wrote to memory of 1476 2624 svchost.com 202405~1.EXE PID 2624 wrote to memory of 1476 2624 svchost.com 202405~1.EXE PID 1476 wrote to memory of 1516 1476 202405~1.EXE svchost.com PID 1476 wrote to memory of 1516 1476 202405~1.EXE svchost.com PID 1476 wrote to memory of 1516 1476 202405~1.EXE svchost.com PID 1476 wrote to memory of 1516 1476 202405~1.EXE svchost.com PID 1516 wrote to memory of 2320 1516 svchost.com 202405~1.EXE PID 1516 wrote to memory of 2320 1516 svchost.com 202405~1.EXE PID 1516 wrote to memory of 2320 1516 svchost.com 202405~1.EXE PID 1516 wrote to memory of 2320 1516 svchost.com 202405~1.EXE PID 2320 wrote to memory of 376 2320 202405~1.EXE svchost.com PID 2320 wrote to memory of 376 2320 202405~1.EXE svchost.com PID 2320 wrote to memory of 376 2320 202405~1.EXE svchost.com PID 2320 wrote to memory of 376 2320 202405~1.EXE svchost.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe"C:\Users\Admin\AppData\Local\Temp\202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\202405222219802df8a09e0ce53ddf7dc5fde337hiddentearneshta.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE10⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE16⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE18⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE20⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE22⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE24⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE26⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE28⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE30⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE32⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE34⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE36⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE38⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE40⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE42⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE44⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE46⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE48⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE50⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE52⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE54⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE56⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE58⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE60⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"61⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE62⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"63⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE64⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"65⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE66⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"67⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE68⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"69⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE70⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"71⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE72⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"73⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE74⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"75⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE76⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"77⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE78⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"79⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE80⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"81⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE82⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"83⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE84⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"85⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE86⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"87⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE88⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"89⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE90⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"91⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE92⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"93⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE94⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"95⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE96⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"97⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE98⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"99⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE100⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"101⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE102⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"103⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE104⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"105⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE106⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"107⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE108⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"109⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE110⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"111⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE112⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"113⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE114⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"115⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE116⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"117⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE118⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"119⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE120⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"121⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE122⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"123⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE124⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"125⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE126⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"127⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE128⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"129⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE130⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"131⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE132⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"133⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE134⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"135⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE136⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"137⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE138⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"139⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE140⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"141⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE142⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"143⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE144⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"145⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE146⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"147⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE148⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"149⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE150⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"151⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE152⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"153⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE154⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"155⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE156⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"157⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE158⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"159⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE160⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"161⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE162⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"163⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE164⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"165⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE166⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"167⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE168⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"169⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE170⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"171⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE172⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"173⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE174⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"175⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE176⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"177⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE178⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"179⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE180⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"181⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE182⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"183⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE184⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"185⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE186⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"187⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE188⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"189⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE190⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"191⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE192⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"193⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE194⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"195⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE196⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"197⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE198⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"199⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE200⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"201⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE202⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"203⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE204⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"205⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE206⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"207⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE208⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"209⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE210⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"211⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE212⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"213⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE214⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"215⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE216⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"217⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE218⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"219⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE220⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"221⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE222⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"223⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE224⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"225⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE226⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"227⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE228⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"229⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE230⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"231⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE232⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"233⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE234⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"235⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE236⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"237⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE238⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"239⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE240⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\202405~1.EXE"241⤵
- Drops file in Windows directory