Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 00:41
Behavioral task
behavioral1
Sample
9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe
Resource
win7-20240419-en
General
-
Target
9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe
-
Size
158KB
-
MD5
629205c3fafec1ec163409031790146d
-
SHA1
1bd9432378e21774324a4f0e34f4f6933ccb94b0
-
SHA256
9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79
-
SHA512
40305f90a85572da5269c0f5c9589f5ddb5c603e8cad6faebc2f9de53cdee99781970447f194822ed912c77f3abe0956996d4ee4e1f7edd4c7b06b497ada6e45
-
SSDEEP
1536:JxqjQ+P04wsmJCu8SBKygMc5FWF96RDW3Mz8c+nowfs6Zfe7MI8ACc+aprlOxqjh:sr85CpSfg5Fo6xdwc+08anp9r85C
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\3582-490\9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe family_neshta C:\Windows\svchost.com family_neshta behavioral2/memory/3600-16-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2556-27-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4336-28-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/5068-32-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3872-40-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/912-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4460-52-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3868-62-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/5028-64-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3604-68-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4164-76-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE family_neshta behavioral2/memory/1612-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE family_neshta behavioral2/memory/4892-114-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe family_neshta C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE family_neshta behavioral2/memory/2036-124-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/464-126-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3444-130-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe family_neshta C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe family_neshta C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe family_neshta C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe family_neshta behavioral2/memory/2480-179-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\msedge.exe family_neshta C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\INSTAL~1\setup.exe family_neshta C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\identity_helper.exe family_neshta C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\elevation_service.exe family_neshta C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\cookie_exporter.exe family_neshta C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\BHO\ie_to_edge_stub.exe family_neshta C:\PROGRA~2\Google\Update\DISABL~1.EXE family_neshta C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE family_neshta C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\msedgewebview2.exe family_neshta C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE family_neshta C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE family_neshta behavioral2/memory/1080-212-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4324-221-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3428-214-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4456-237-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/880-244-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3432-253-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2356-255-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2596-262-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4156-268-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3556-269-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4864-271-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4728-277-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4184-279-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3164-285-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4788-287-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4660-293-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1352-300-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2576-301-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3160-303-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4708-309-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3736-311-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Modifies security service 2 TTPs 3 IoCs
Processes:
sysmablsvr.exewinblrsnrcs.exe294231135.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" 294231135.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Phorphiex payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\3582-490\9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe family_phorphiex C:\Windows\mwupsrcvc.exe family_phorphiex C:\Windows\sysvratrel.exe family_phorphiex C:\Windows\sysmablsvr.exe family_phorphiex -
Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
Processes:
3654830204.exewupgrdsv.exedescription pid process target process PID 2968 created 3512 2968 3654830204.exe Explorer.EXE PID 2968 created 3512 2968 3654830204.exe Explorer.EXE PID 3700 created 3512 3700 wupgrdsv.exe Explorer.EXE PID 3700 created 3512 3700 wupgrdsv.exe Explorer.EXE -
Processes:
winblrsnrcs.exemwupsrcvc.exe294231135.exesysmablsvr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" mwupsrcvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 294231135.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 294231135.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 294231135.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 294231135.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 294231135.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" mwupsrcvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" mwupsrcvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" mwupsrcvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" mwupsrcvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" mwupsrcvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 294231135.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXEdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 949366~1.EXE -
Executes dropped EXE 64 IoCs
Processes:
9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exesvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.compid process 2692 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe 3600 svchost.com 2556 949366~1.EXE 4336 svchost.com 5068 949366~1.EXE 3872 svchost.com 912 949366~1.EXE 4460 svchost.com 3868 949366~1.EXE 5028 svchost.com 3604 949366~1.EXE 4164 svchost.com 1612 949366~1.EXE 4892 svchost.com 2036 949366~1.EXE 464 svchost.com 3444 949366~1.EXE 2480 svchost.com 1080 949366~1.EXE 3428 svchost.com 4324 949366~1.EXE 4456 svchost.com 880 949366~1.EXE 3432 svchost.com 2356 949366~1.EXE 2596 svchost.com 4156 949366~1.EXE 3556 svchost.com 4864 949366~1.EXE 4728 svchost.com 4184 949366~1.EXE 3164 svchost.com 4788 949366~1.EXE 4660 svchost.com 1352 949366~1.EXE 2576 svchost.com 3160 949366~1.EXE 4708 svchost.com 3736 949366~1.EXE 3892 svchost.com 2172 949366~1.EXE 2684 svchost.com 5088 949366~1.EXE 4832 svchost.com 4756 949366~1.EXE 1744 svchost.com 3668 949366~1.EXE 4456 svchost.com 3548 949366~1.EXE 2368 svchost.com 3432 949366~1.EXE 1492 svchost.com 636 949366~1.EXE 5024 svchost.com 1104 949366~1.EXE 4732 svchost.com 2776 949366~1.EXE 1472 svchost.com 3164 949366~1.EXE 2812 svchost.com 4432 949366~1.EXE 3612 svchost.com 4580 949366~1.EXE 4468 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
294231135.exemwupsrcvc.exesysmablsvr.exewinblrsnrcs.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 294231135.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" mwupsrcvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" mwupsrcvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 294231135.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 294231135.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" mwupsrcvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" mwupsrcvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" mwupsrcvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" mwupsrcvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" 294231135.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 294231135.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" mwupsrcvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 294231135.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 294231135.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winblrsnrcs.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
762519103.exe949366~1.EXE294231135.exe337305550.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Windows\\winblrsnrcs.exe" 762519103.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\mwupsrcvc.exe" 949366~1.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysvratrel.exe" 294231135.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\sysvratrel.exe" 294231135.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmablsvr.exe" 337305550.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
wupgrdsv.exedescription pid process target process PID 3700 set thread context of 1152 3700 wupgrdsv.exe notepad.exe -
Drops file in Program Files directory 64 IoCs
Processes:
9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exedescription ioc process File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~3.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\elevation_service.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\msedge.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\notification_click_helper.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\msedgewebview2.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~4.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~4.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~2.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\identity_helper.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\msedge_pwa_launcher.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\notification_helper.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\java.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe -
Drops file in Windows directory 64 IoCs
Processes:
svchost.comsvchost.comsvchost.comsvchost.com949366~1.EXEsvchost.comsvchost.com949366~1.EXE949366~1.EXEsvchost.comsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.comsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.comsvchost.com949366~1.EXEsvchost.comsvchost.com949366~1.EXEsvchost.com949366~1.EXE949366~1.EXEsvchost.com949366~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com949366~1.EXEsvchost.comsvchost.comsvchost.comsvchost.com949366~1.EXEsvchost.comsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXE949366~1.EXEsvchost.comsvchost.com949366~1.EXEsvchost.comsvchost.comdescription ioc process File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 949366~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 949366~1.EXE File opened for modification C:\Windows\directx.sys 949366~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 949366~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 949366~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 949366~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 949366~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 949366~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 949366~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 949366~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 949366~1.EXE File opened for modification C:\Windows\directx.sys 949366~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 949366~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 949366~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 949366~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 949366~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 949366~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 949366~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 949366~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 949366~1.EXE File opened for modification C:\Windows\svchost.com 949366~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 949366~1.EXE File opened for modification C:\Windows\directx.sys 949366~1.EXE File opened for modification C:\Windows\directx.sys 949366~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
Processes:
949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXE949366~1.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 949366~1.EXE -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
3654830204.exepowershell.exewupgrdsv.exepowershell.exepid process 2968 3654830204.exe 2968 3654830204.exe 3472 powershell.exe 3472 powershell.exe 3472 powershell.exe 2968 3654830204.exe 2968 3654830204.exe 3700 wupgrdsv.exe 3700 wupgrdsv.exe 4532 powershell.exe 4532 powershell.exe 4532 powershell.exe 3700 wupgrdsv.exe 3700 wupgrdsv.exe -
Suspicious behavior: SetClipboardViewer 2 IoCs
Processes:
294231135.exesysmablsvr.exepid process 720 294231135.exe 2576 sysmablsvr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3472 powershell.exe Token: SeIncreaseQuotaPrivilege 3472 powershell.exe Token: SeSecurityPrivilege 3472 powershell.exe Token: SeTakeOwnershipPrivilege 3472 powershell.exe Token: SeLoadDriverPrivilege 3472 powershell.exe Token: SeSystemProfilePrivilege 3472 powershell.exe Token: SeSystemtimePrivilege 3472 powershell.exe Token: SeProfSingleProcessPrivilege 3472 powershell.exe Token: SeIncBasePriorityPrivilege 3472 powershell.exe Token: SeCreatePagefilePrivilege 3472 powershell.exe Token: SeBackupPrivilege 3472 powershell.exe Token: SeRestorePrivilege 3472 powershell.exe Token: SeShutdownPrivilege 3472 powershell.exe Token: SeDebugPrivilege 3472 powershell.exe Token: SeSystemEnvironmentPrivilege 3472 powershell.exe Token: SeRemoteShutdownPrivilege 3472 powershell.exe Token: SeUndockPrivilege 3472 powershell.exe Token: SeManageVolumePrivilege 3472 powershell.exe Token: 33 3472 powershell.exe Token: 34 3472 powershell.exe Token: 35 3472 powershell.exe Token: 36 3472 powershell.exe Token: SeIncreaseQuotaPrivilege 3472 powershell.exe Token: SeSecurityPrivilege 3472 powershell.exe Token: SeTakeOwnershipPrivilege 3472 powershell.exe Token: SeLoadDriverPrivilege 3472 powershell.exe Token: SeSystemProfilePrivilege 3472 powershell.exe Token: SeSystemtimePrivilege 3472 powershell.exe Token: SeProfSingleProcessPrivilege 3472 powershell.exe Token: SeIncBasePriorityPrivilege 3472 powershell.exe Token: SeCreatePagefilePrivilege 3472 powershell.exe Token: SeBackupPrivilege 3472 powershell.exe Token: SeRestorePrivilege 3472 powershell.exe Token: SeShutdownPrivilege 3472 powershell.exe Token: SeDebugPrivilege 3472 powershell.exe Token: SeSystemEnvironmentPrivilege 3472 powershell.exe Token: SeRemoteShutdownPrivilege 3472 powershell.exe Token: SeUndockPrivilege 3472 powershell.exe Token: SeManageVolumePrivilege 3472 powershell.exe Token: 33 3472 powershell.exe Token: 34 3472 powershell.exe Token: 35 3472 powershell.exe Token: 36 3472 powershell.exe Token: SeIncreaseQuotaPrivilege 3472 powershell.exe Token: SeSecurityPrivilege 3472 powershell.exe Token: SeTakeOwnershipPrivilege 3472 powershell.exe Token: SeLoadDriverPrivilege 3472 powershell.exe Token: SeSystemProfilePrivilege 3472 powershell.exe Token: SeSystemtimePrivilege 3472 powershell.exe Token: SeProfSingleProcessPrivilege 3472 powershell.exe Token: SeIncBasePriorityPrivilege 3472 powershell.exe Token: SeCreatePagefilePrivilege 3472 powershell.exe Token: SeBackupPrivilege 3472 powershell.exe Token: SeRestorePrivilege 3472 powershell.exe Token: SeShutdownPrivilege 3472 powershell.exe Token: SeDebugPrivilege 3472 powershell.exe Token: SeSystemEnvironmentPrivilege 3472 powershell.exe Token: SeRemoteShutdownPrivilege 3472 powershell.exe Token: SeUndockPrivilege 3472 powershell.exe Token: SeManageVolumePrivilege 3472 powershell.exe Token: 33 3472 powershell.exe Token: 34 3472 powershell.exe Token: 35 3472 powershell.exe Token: 36 3472 powershell.exe -
Suspicious use of FindShellTrayWindow 41 IoCs
Processes:
notepad.exepid process 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe -
Suspicious use of SendNotifyMessage 41 IoCs
Processes:
notepad.exepid process 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe 1152 notepad.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exesvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEsvchost.com949366~1.EXEdescription pid process target process PID 4060 wrote to memory of 2692 4060 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe PID 4060 wrote to memory of 2692 4060 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe PID 4060 wrote to memory of 2692 4060 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe PID 2692 wrote to memory of 3600 2692 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe svchost.com PID 2692 wrote to memory of 3600 2692 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe svchost.com PID 2692 wrote to memory of 3600 2692 9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe svchost.com PID 3600 wrote to memory of 2556 3600 svchost.com 949366~1.EXE PID 3600 wrote to memory of 2556 3600 svchost.com 949366~1.EXE PID 3600 wrote to memory of 2556 3600 svchost.com 949366~1.EXE PID 2556 wrote to memory of 4336 2556 949366~1.EXE svchost.com PID 2556 wrote to memory of 4336 2556 949366~1.EXE svchost.com PID 2556 wrote to memory of 4336 2556 949366~1.EXE svchost.com PID 4336 wrote to memory of 5068 4336 svchost.com 949366~1.EXE PID 4336 wrote to memory of 5068 4336 svchost.com 949366~1.EXE PID 4336 wrote to memory of 5068 4336 svchost.com 949366~1.EXE PID 5068 wrote to memory of 3872 5068 949366~1.EXE svchost.com PID 5068 wrote to memory of 3872 5068 949366~1.EXE svchost.com PID 5068 wrote to memory of 3872 5068 949366~1.EXE svchost.com PID 3872 wrote to memory of 912 3872 svchost.com svchost.com PID 3872 wrote to memory of 912 3872 svchost.com svchost.com PID 3872 wrote to memory of 912 3872 svchost.com svchost.com PID 912 wrote to memory of 4460 912 949366~1.EXE svchost.com PID 912 wrote to memory of 4460 912 949366~1.EXE svchost.com PID 912 wrote to memory of 4460 912 949366~1.EXE svchost.com PID 4460 wrote to memory of 3868 4460 svchost.com 949366~1.EXE PID 4460 wrote to memory of 3868 4460 svchost.com 949366~1.EXE PID 4460 wrote to memory of 3868 4460 svchost.com 949366~1.EXE PID 3868 wrote to memory of 5028 3868 949366~1.EXE svchost.com PID 3868 wrote to memory of 5028 3868 949366~1.EXE svchost.com PID 3868 wrote to memory of 5028 3868 949366~1.EXE svchost.com PID 5028 wrote to memory of 3604 5028 svchost.com 949366~1.EXE PID 5028 wrote to memory of 3604 5028 svchost.com 949366~1.EXE PID 5028 wrote to memory of 3604 5028 svchost.com 949366~1.EXE PID 3604 wrote to memory of 4164 3604 949366~1.EXE svchost.com PID 3604 wrote to memory of 4164 3604 949366~1.EXE svchost.com PID 3604 wrote to memory of 4164 3604 949366~1.EXE svchost.com PID 4164 wrote to memory of 1612 4164 svchost.com 949366~1.EXE PID 4164 wrote to memory of 1612 4164 svchost.com 949366~1.EXE PID 4164 wrote to memory of 1612 4164 svchost.com 949366~1.EXE PID 1612 wrote to memory of 4892 1612 949366~1.EXE svchost.com PID 1612 wrote to memory of 4892 1612 949366~1.EXE svchost.com PID 1612 wrote to memory of 4892 1612 949366~1.EXE svchost.com PID 4892 wrote to memory of 2036 4892 svchost.com 949366~1.EXE PID 4892 wrote to memory of 2036 4892 svchost.com 949366~1.EXE PID 4892 wrote to memory of 2036 4892 svchost.com 949366~1.EXE PID 2036 wrote to memory of 464 2036 949366~1.EXE svchost.com PID 2036 wrote to memory of 464 2036 949366~1.EXE svchost.com PID 2036 wrote to memory of 464 2036 949366~1.EXE svchost.com PID 464 wrote to memory of 3444 464 svchost.com 949366~1.EXE PID 464 wrote to memory of 3444 464 svchost.com 949366~1.EXE PID 464 wrote to memory of 3444 464 svchost.com 949366~1.EXE PID 3444 wrote to memory of 2480 3444 949366~1.EXE svchost.com PID 3444 wrote to memory of 2480 3444 949366~1.EXE svchost.com PID 3444 wrote to memory of 2480 3444 949366~1.EXE svchost.com PID 2480 wrote to memory of 1080 2480 svchost.com 949366~1.EXE PID 2480 wrote to memory of 1080 2480 svchost.com 949366~1.EXE PID 2480 wrote to memory of 1080 2480 svchost.com 949366~1.EXE PID 1080 wrote to memory of 3428 1080 949366~1.EXE svchost.com PID 1080 wrote to memory of 3428 1080 949366~1.EXE svchost.com PID 1080 wrote to memory of 3428 1080 949366~1.EXE svchost.com PID 3428 wrote to memory of 4324 3428 svchost.com 949366~1.EXE PID 3428 wrote to memory of 4324 3428 svchost.com 949366~1.EXE PID 3428 wrote to memory of 4324 3428 svchost.com 949366~1.EXE PID 4324 wrote to memory of 4456 4324 949366~1.EXE svchost.com -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe"C:\Users\Admin\AppData\Local\Temp\9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe"2⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\9493660c3d8cd4ddb6df8fee3c8f1470c876cf9076311e5f26c3fd4218a74b79.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE7⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"8⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE9⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"10⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE19⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"22⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE23⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"24⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE25⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"26⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE27⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"28⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE29⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"30⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE31⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"32⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE33⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"34⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE35⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"36⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE37⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"38⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE39⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"40⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE41⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"42⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE43⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"44⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE45⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"46⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE47⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"48⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE49⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"50⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE51⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"52⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE53⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"54⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE55⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"56⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE57⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"58⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE59⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"60⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE61⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"62⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE63⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"64⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE65⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"66⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE67⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"68⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE69⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"70⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE71⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"72⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE73⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"74⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE75⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"76⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE77⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"78⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE79⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"80⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE81⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"82⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE83⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"84⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE85⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"86⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE87⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"88⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE89⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"90⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE91⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"92⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE93⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"94⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE95⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"96⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE97⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"98⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE99⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"100⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE101⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"102⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE103⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"104⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE105⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"106⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE107⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"108⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE109⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"110⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE111⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"112⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE113⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"114⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE115⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"116⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE117⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"118⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE119⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"120⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE121⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"122⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE123⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"124⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE125⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"126⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE127⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"128⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE129⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"130⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE131⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"132⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE133⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"134⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE135⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"136⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE137⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"138⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE139⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"140⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE141⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"142⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE143⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"144⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE145⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"146⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE147⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"148⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE149⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"150⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE151⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"152⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE153⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"154⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE155⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"156⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE157⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"158⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE159⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"160⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE161⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"162⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE163⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"164⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE165⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"166⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE167⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"168⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE169⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"170⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE171⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"172⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE173⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"174⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE175⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"176⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE177⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"178⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE179⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"180⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE181⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"182⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE183⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"184⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE185⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"186⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE187⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"188⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE189⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"190⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE191⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"192⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE193⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"194⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE195⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"196⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE197⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"198⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE199⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"200⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE201⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"202⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE203⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"204⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE205⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"206⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE207⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"208⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE209⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"210⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE211⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"212⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE213⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"214⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE215⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"216⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE217⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"218⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE219⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"220⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE221⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"222⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE223⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"224⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE225⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"226⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE227⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"228⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE229⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"230⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE231⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"232⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE233⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"234⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE235⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"236⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE237⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"238⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE239⤵
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE"240⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\949366~1.EXE241⤵
- Checks computer location settings
- Modifies registry class