Malware Analysis Report

2025-08-11 00:26

Sample ID 221001-wj35lsaedn
Target b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced
SHA256 b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced
Tags
neshta persistence spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced

Threat Level: Known bad

The file b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced was found to be: Known bad.

Malicious Activity Summary

neshta persistence spyware stealer upx

Modifies system executable filetype association

Detect Neshta payload

Neshta family

Neshta

Executes dropped EXE

UPX packed file

Loads dropped DLL

Reads user/profile data of web browsers

Checks computer location settings

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-01 17:58

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A

Neshta family

neshta

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-01 17:57

Reported

2022-10-01 18:10

Platform

win7-20220901-en

Max time kernel

86s

Max time network

46s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A

Neshta

persistence spyware neshta

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1124 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe C:\Users\Admin\AppData\Local\Temp\3582-490\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe
PID 1124 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe C:\Users\Admin\AppData\Local\Temp\3582-490\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe
PID 1124 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe C:\Users\Admin\AppData\Local\Temp\3582-490\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe
PID 1124 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe C:\Users\Admin\AppData\Local\Temp\3582-490\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe
PID 1732 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe C:\Windows\svchost.com
PID 1732 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe C:\Windows\svchost.com
PID 1732 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe C:\Windows\svchost.com
PID 1732 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe C:\Windows\svchost.com
PID 1176 wrote to memory of 1284 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\TEAMVI~1\Version7\TEAMVI~1.EXE
PID 1176 wrote to memory of 1284 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\TEAMVI~1\Version7\TEAMVI~1.EXE
PID 1176 wrote to memory of 1284 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\TEAMVI~1\Version7\TEAMVI~1.EXE
PID 1176 wrote to memory of 1284 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\TEAMVI~1\Version7\TEAMVI~1.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe

"C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\TEAMVI~1\Version7\TEAMVI~1.EXE"

C:\Users\Admin\AppData\Local\Temp\TEAMVI~1\Version7\TEAMVI~1.EXE

C:\Users\Admin\AppData\Local\Temp\TEAMVI~1\Version7\TEAMVI~1.EXE

Network

N/A

Files

memory/1124-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

\Users\Admin\AppData\Local\Temp\3582-490\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe

MD5 ebc35ee0fb935102508f8d093de5dc75
SHA1 b499084cd5d95e3c1ece0616eab6c593c1049e8d
SHA256 0f5f032332f7c343f0d8dfa9561a18b44da8106bac9885feac44fa83e35066d7
SHA512 fc6e96d5addee2c682b0ad4632378aacee909d40e60182353f01c120bdd6d2a97ca9c0afc8ebb0e668535fdd9d658ddff262a9d253324c3cfca1b3053abae1f9

memory/1732-56-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe

MD5 ebc35ee0fb935102508f8d093de5dc75
SHA1 b499084cd5d95e3c1ece0616eab6c593c1049e8d
SHA256 0f5f032332f7c343f0d8dfa9561a18b44da8106bac9885feac44fa83e35066d7
SHA512 fc6e96d5addee2c682b0ad4632378aacee909d40e60182353f01c120bdd6d2a97ca9c0afc8ebb0e668535fdd9d658ddff262a9d253324c3cfca1b3053abae1f9

memory/1124-59-0x00000000024B0000-0x00000000024EE000-memory.dmp

memory/1732-60-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe

MD5 ebc35ee0fb935102508f8d093de5dc75
SHA1 b499084cd5d95e3c1ece0616eab6c593c1049e8d
SHA256 0f5f032332f7c343f0d8dfa9561a18b44da8106bac9885feac44fa83e35066d7
SHA512 fc6e96d5addee2c682b0ad4632378aacee909d40e60182353f01c120bdd6d2a97ca9c0afc8ebb0e668535fdd9d658ddff262a9d253324c3cfca1b3053abae1f9

\Users\Admin\AppData\Local\Temp\nsd3F24.tmp\TvGetVersion.dll

MD5 b7641fc2d6eb0b3d81347d4936ced0bd
SHA1 f05955337fbb1dd1974021927a8c07fefae6637b
SHA256 681cb2b67e87915f37b6f716d53626b939d534c0c3e5e9810ad025760c798270
SHA512 f7f006a7855beaaecd0159b7e4bc2d2cd6d8b1bceb1f1f2b4e73382d34aa07cbf9c3cfadd882fe79c6b971143b04fb02410ede77c7c89b429068207d3d7ddb0a

C:\Windows\svchost.com

MD5 ea97b5948b7a39ed51b27366433b14bf
SHA1 431862a792c40d11fc200af3191358768df1a50d
SHA256 9bb8da63d146a60cc76c7aa73a1e31fcaac703968cd765ce261886ed6ee26b0b
SHA512 cb2941639617317627b1c5a3cd01b24af547b9b05e0cef39638a5d0faf2037fd884e7930b7522aed67f7b56954a64cf57a76df2c6179c7dbfcbae063da133a46

memory/1176-64-0x0000000000000000-mapping.dmp

memory/1732-66-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Windows\svchost.com

MD5 ea97b5948b7a39ed51b27366433b14bf
SHA1 431862a792c40d11fc200af3191358768df1a50d
SHA256 9bb8da63d146a60cc76c7aa73a1e31fcaac703968cd765ce261886ed6ee26b0b
SHA512 cb2941639617317627b1c5a3cd01b24af547b9b05e0cef39638a5d0faf2037fd884e7930b7522aed67f7b56954a64cf57a76df2c6179c7dbfcbae063da133a46

C:\Users\Admin\AppData\Local\Temp\TEAMVI~1\Version7\TEAMVI~1.EXE

MD5 a971db0e311901bc928f1acb15ed710c
SHA1 00060089e8de815cf9ed2ebe883ccb2b3a171efd
SHA256 810bd053018dd55f8a54e364f03ae6522f037e95328573428012b28c799e1ee4
SHA512 88e7c74fa772a74a2974c311492c7f3ac2690740f53006a2a9dabdbfc0e85b13663edac12b230764c6acecfb49d6238fea77dda4ed8abd4e62bd7f715276dfc9

\Users\Admin\AppData\Local\Temp\TEAMVI~1\Version7\TEAMVI~1.EXE

MD5 a971db0e311901bc928f1acb15ed710c
SHA1 00060089e8de815cf9ed2ebe883ccb2b3a171efd
SHA256 810bd053018dd55f8a54e364f03ae6522f037e95328573428012b28c799e1ee4
SHA512 88e7c74fa772a74a2974c311492c7f3ac2690740f53006a2a9dabdbfc0e85b13663edac12b230764c6acecfb49d6238fea77dda4ed8abd4e62bd7f715276dfc9

memory/1284-70-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\TEAMVI~1\Version7\TEAMVI~1.EXE

MD5 a971db0e311901bc928f1acb15ed710c
SHA1 00060089e8de815cf9ed2ebe883ccb2b3a171efd
SHA256 810bd053018dd55f8a54e364f03ae6522f037e95328573428012b28c799e1ee4
SHA512 88e7c74fa772a74a2974c311492c7f3ac2690740f53006a2a9dabdbfc0e85b13663edac12b230764c6acecfb49d6238fea77dda4ed8abd4e62bd7f715276dfc9

\Users\Admin\AppData\Local\Temp\nst44B1.tmp\TvGetVersion.dll

MD5 54a82ad8fe612b1bfe5dc7406d1bd0b5
SHA1 02f1ebb115ef64fe54ca2d1787b04119f05afff6
SHA256 80c4332936d17604a2327ae7575fd8553219bd06a35c055ff9f0face1a7a5d59
SHA512 c2d00a87ecb5f4ec6e3862d0864f124bc77f95ec45a4b76fabb640a437ea1903a37f4ed123aefb39b54122329c85bde505dd3dded452c319a11ba2b5990001fe

\Users\Admin\AppData\Local\Temp\nst44B1.tmp\TvGetVersion.dll

MD5 54a82ad8fe612b1bfe5dc7406d1bd0b5
SHA1 02f1ebb115ef64fe54ca2d1787b04119f05afff6
SHA256 80c4332936d17604a2327ae7575fd8553219bd06a35c055ff9f0face1a7a5d59
SHA512 c2d00a87ecb5f4ec6e3862d0864f124bc77f95ec45a4b76fabb640a437ea1903a37f4ed123aefb39b54122329c85bde505dd3dded452c319a11ba2b5990001fe

\Users\Admin\AppData\Local\Temp\nst44B1.tmp\System.dll

MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

\Users\Admin\AppData\Local\Temp\nst44B1.tmp\UserInfo.dll

MD5 c7ce0e47c83525983fd2c4c9566b4aad
SHA1 38b7ad7bb32ffae35540fce373b8a671878dc54e
SHA256 6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae
SHA512 ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e

\Users\Admin\AppData\Local\Temp\nst44B1.tmp\UserInfo.dll

MD5 c7ce0e47c83525983fd2c4c9566b4aad
SHA1 38b7ad7bb32ffae35540fce373b8a671878dc54e
SHA256 6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae
SHA512 ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e

\Users\Admin\AppData\Local\Temp\nst44B1.tmp\TvGetVersion.dll

MD5 54a82ad8fe612b1bfe5dc7406d1bd0b5
SHA1 02f1ebb115ef64fe54ca2d1787b04119f05afff6
SHA256 80c4332936d17604a2327ae7575fd8553219bd06a35c055ff9f0face1a7a5d59
SHA512 c2d00a87ecb5f4ec6e3862d0864f124bc77f95ec45a4b76fabb640a437ea1903a37f4ed123aefb39b54122329c85bde505dd3dded452c319a11ba2b5990001fe

\Users\Admin\AppData\Local\Temp\nst44B1.tmp\InstallOptions.dll

MD5 89351a0a6a89519c86c5531e20dab9ea
SHA1 9e801aaaae9e70d8f7fc52f6f12cedc55e4c8a00
SHA256 f530069ef87a1c163c4fd63a3d5b053420ce3d7a98739c70211b4a99f90d6277
SHA512 13168fa828b581383e5f64d3b54be357e98d2eb9362b45685e7426ffc2f0696ab432cc8a3f374ce8abd03c096f1662d954877afa886fc4aa74709e6044b75c08

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe

MD5 566ed4f62fdc96f175afedd811fa0370
SHA1 d4b47adc40e0d5a9391d3f6f2942d1889dd2a451
SHA256 e17cd94c08fc0e001a49f43a0801cea4625fb9aee211b6dfebebec446c21f460
SHA512 cdf8f508d396a1a0d2e0fc25f2ae46398b25039a0dafa0919737cc44e3e926ebae4c3aa26f1a3441511430f1a36241f8e61c515a5d9bd98ad4740d4d0f7b8db7

C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe

MD5 58b58875a50a0d8b5e7be7d6ac685164
SHA1 1e0b89c1b2585c76e758e9141b846ed4477b0662
SHA256 2a0aa0763fdef9c38c5dd4d50703f0c7e27f4903c139804ec75e55f8388139ae
SHA512 d67214077162a105d01b11a8e207fab08b45b08fbfba0615a2ea146e1dd99eea35e4f02958a1754d3192292c00caf777f186f0a362e4b8b0da51fabbdb76375b

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

MD5 cf6c595d3e5e9667667af096762fd9c4
SHA1 9bb44da8d7f6457099cb56e4f7d1026963dce7ce
SHA256 593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
SHA512 ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE

MD5 02ee6a3424782531461fb2f10713d3c1
SHA1 b581a2c365d93ebb629e8363fd9f69afc673123f
SHA256 ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc
SHA512 6c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec

C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE

MD5 8c4f4eb73490ca2445d8577cf4bb3c81
SHA1 0f7d1914b7aeabdb1f1e4caedd344878f48be075
SHA256 85f7249bfac06b5ee9b20c7f520e3fdc905be7d64cfbefb7dcd82cd8d44686d5
SHA512 65453075c71016b06430246c1ee2876b7762a03112caf13cff4699b7b40487616c88a1160d31e86697083e2992e0dd88ebf1721679981077799187efaa0a1769

C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE

MD5 eef2f834c8d65585af63916d23b07c36
SHA1 8cb85449d2cdb21bd6def735e1833c8408b8a9c6
SHA256 3cd34a88e3ae7bd3681a7e3c55832af026834055020add33e6bd6f552fc0aabd
SHA512 2ee8766e56e5b1e71c86f7d1a1aa1882706d0bca8f84b2b2c54dd4c255e04f037a6eb265302449950e5f5937b0e57f17a6aa45e88a407ace4b3945e65043d9b7

C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe

MD5 467aee41a63b9936ce9c5cbb3fa502cd
SHA1 19403cac6a199f6cd77fc5ac4a6737a9a9782dc8
SHA256 99e5bea5f632ef4af76e4e5108486d5e99386c3d451b983bcd3ad2a49cc04039
SHA512 00c9ccdbbd6fd1be0c2dafd485d811be9bf2076d4efeabc256179befd92679b964e80edcb90ef21f3e874578fdb0003878227f560ca76498865770280f87113e

C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE

MD5 58b58875a50a0d8b5e7be7d6ac685164
SHA1 1e0b89c1b2585c76e758e9141b846ed4477b0662
SHA256 2a0aa0763fdef9c38c5dd4d50703f0c7e27f4903c139804ec75e55f8388139ae
SHA512 d67214077162a105d01b11a8e207fab08b45b08fbfba0615a2ea146e1dd99eea35e4f02958a1754d3192292c00caf777f186f0a362e4b8b0da51fabbdb76375b

C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe

MD5 034978c5262186b14fd7a2892e30b1cf
SHA1 237397dd3b97c762522542c57c85c3ff96646ba8
SHA256 159776d43dd2a8d843b82ece0faf469f9088a625d474ce4eea9db59d94a844e6
SHA512 d216e757616121d9902b0db2669b6e2aa9eb2697427c9ea2804ebda9690abbf9219c6e603d63ff19dc6115a072985ca862499b5f8319ca057a16e81aec9ea949

C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe

MD5 60f6a975a53a542fd1f6e617f3906d86
SHA1 2be1ae6fffb3045fd67ed028fe6b22e235a3d089
SHA256 be23688697af7b859d62519807414565308e79a6ecac221350cd502d6bf54733
SHA512 360872d256ef91ea3debfb9b3efa22ee80859af9df29e0687c8e1b3c386d88ff1dc5635b86e714fbf1a7d4d6bc3d791efa31a9d9d13e0f79547b631bddb5108d

C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe

MD5 da31170e6de3cf8bd6cf7346d9ef5235
SHA1 e2c9602f5c7778f9614672884638efd5dd2aee92
SHA256 7737ab500cbbd5d507881d481eef9bd91cf6650bf8d2b41b47b1a8c5f2789858
SHA512 2759d938d6ad963e0bf63481a700f7c503d06011a60bcfc1071b511e38afa87d903deb36f9cbfa0b3fd08f1ecb88d2c0bddf0d3b5f2dea2a0cca1a80471669f3

C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE

MD5 12a5d7cade13ae01baddf73609f8fbe9
SHA1 34e425f4a21db8d7902a78107d29aec1bde41e06
SHA256 94e8ea2ed536484492d746f6f5808192cb81ae3c35f55d60826a2db64a254dd5
SHA512 a240f5c59226749792cfb9fbd76b086d2544a493b834a72c0bfd8b076ed753ec8876ff056fc35f63f5497183d985f8f8c5c7b6abbcad70981f1ec83af1b3bd76

C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE

MD5 3f67da7e800cd5b4af2283a9d74d2808
SHA1 f9288d052b20a9f4527e5a0f87f4249f5e4440f7
SHA256 31c10320edb2de22f37faee36611558db83b78a9c3c71ea0ed13c8dce25bf711
SHA512 6a40f4629ddae102d8737e921328e95717274cea16eb5f23bff6a6627c6047d7f27e7f6eb5cb52f53152e326e53b6ee44d9a9ee8eca7534a2f62fa457ac3d4e3

C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE

MD5 28f7305b74e1d71409fec722d940d17a
SHA1 4c64e1ceb723f90da09e1a11e677d01fc8118677
SHA256 706db4d832abdf4907a1386b917e553315660a59bfb4c180e38215b4a606d896
SHA512 117de88d0bc437023ca2f1f54b1f2cf03b00c8cb52e4b728cabcb3140659c67cdb6d2c203d3ca13767312831c6308622dfa65d6c5361ec28aaf4ec0870f9ba6e

C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE

MD5 a24fbb149eddf7a0fe981bd06a4c5051
SHA1 fce5bb381a0c449efad3d01bbd02c78743c45093
SHA256 5d13230eae7cd9b4869145c3280f7208788a8e68c9930a5c9aa3e822684a963d
SHA512 1c73b762c340a8d7ea580985ba034a404c859d814690390a6e0b6786575c219db9ca20880ea20313bb244560e36cf24e4dda90229b3084d770495f4ceedfd5de

C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE

MD5 d4fdbb8de6a219f981ffda11aa2b2cc4
SHA1 cca2cffd4cf39277cc56ebd050f313de15aabbf6
SHA256 ba3dc87fca4641e5f5486c4d50c09d087e65264e6c5c885fa6866f6ccb23167b
SHA512 7167e13dbcc8c96114fef5fc7ae19afa31173617db153dd283aa6d8256f6b8c09c8f906f5d418efe9f7f242cdfaef24b93c11c451701c4d56eb48d18de4e88bf

C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE

MD5 cf6c595d3e5e9667667af096762fd9c4
SHA1 9bb44da8d7f6457099cb56e4f7d1026963dce7ce
SHA256 593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
SHA512 ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE

MD5 02ee6a3424782531461fb2f10713d3c1
SHA1 b581a2c365d93ebb629e8363fd9f69afc673123f
SHA256 ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc
SHA512 6c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec

C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE

MD5 6a091285d13370abb4536604b5f2a043
SHA1 8bb4aad8cadbd3894c889de85e7d186369cf6ff1
SHA256 909205de592f50532f01b4ac7b573b891f7e6e596b44ff94187b1ba4bcc296bb
SHA512 9696e4f60a5b1166535ca8ca3fb495d718086463d1a12fa1facc08219ad5b918208ddd2a102f7955e29153b081e05985c4ae6e4302ab36d548bb62991a47db18

C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE

MD5 a741183f8c4d83467c51abab1ff68d7b
SHA1 ddb4a6f3782c0f03f282c2bed765d7b065aadcc6
SHA256 78be3aeb507db7e4ee7468c6b9384ee0459deebd503e06bd4988c52247ecea24
SHA512 c15dbecc0754a662892ecaff4b9b6c1bad46f710d8e1b973f86eaee467444f8e5764b31ace8f5a9a5e936947cc4dcb97cb1b14a6930c1025f38a3544393b6b18

C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE

MD5 7ce8bcabb035b3de517229dbe7c5e67d
SHA1 8e43cd79a7539d240e7645f64fd7f6e9e0f90ab9
SHA256 81a3a1dc3104973a100bf8d114b6be35da03767a0cbbaf925f970ffcbe5f217c
SHA512 be7fcd50b4f71b458ca001b7c019bf1169ec089d7a1ce05355134b11cbe75a5a29811f9efec803877aeb1a1d576ea2628926e0131361db23214275af6e89e80c

C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe

MD5 2f6f7891de512f6269c8e8276aa3ea3e
SHA1 53f648c482e2341b4718a60f9277198711605c80
SHA256 d1ee54eb64f31247f182fd62037e64cdb3876e1100bc24883192bf46bab42c86
SHA512 c677f4f7bfb2e02cd0babed896be00567aad08304cbff3a85fcc9816b10247fedd026fee769c9bd45277a4f2814eabe6534f0b04ea804d0095a47a1477188dd6

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe

MD5 e1833678885f02b5e3cf1b3953456557
SHA1 c197e763500002bc76a8d503933f1f6082a8507a
SHA256 bd9a16d8d7590a2ec827913db5173f8beb1d1ef44dab1920ef52a307f922bc14
SHA512 fe107e1c8631ec6ac94f772e6a7be1fdc2a533fe3cfcf36b1ff018c8d01bd7f1f818f0a2448f736838c953cd516ea7327c416dea20706ed2420327af8ef01abe

C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe

MD5 3ec4922dbca2d07815cf28144193ded9
SHA1 75cda36469743fbc292da2684e76a26473f04a6d
SHA256 0587fd366ea7e94b3ae500874b1c5d684b5357fcc7389682d5a13c3301a28801
SHA512 956c3a1f2689cb72600edd2e90d652b77592a8a81d319dce026e88f6c02231af06aebd57d68460eb406de00c113522173423cb1b339a41a3918f379c7dc311f7

C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE

MD5 831270ac3db358cdbef5535b0b3a44e6
SHA1 c0423685c09bbe465f6bb7f8672c936e768f05a3
SHA256 a8f78ac26c738b13564252f1048ca784bf152ef048b829d3d22650b7f62078f0
SHA512 f64a00977d4b6f8c43f53cee7bb450f3c8cbef08525975055fde5d8c515db32d2bfad92e99313b3a10a72a50dd09b4ffe28e9af4c148c6480622ba486776e450

C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE

MD5 154b891ad580307b09612e413a0e65ac
SHA1 fc900c7853261253b6e9f86335ea8d8ad10c1c60
SHA256 8a3598c889dbcb1dca548a6193517ed7becb74c780003203697a2db22222a483
SHA512 39bf032033b445fc5f450abec298ea3f71cadecfeafc624f2eb1f9a1d343a272181a874b46b58bb18168f2f14d498c3b917c3392d4c724fe4e5ae749113c2ad6

C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE

MD5 328a15382885fe27a2fbe65a6b6c8b82
SHA1 032fde6f0898393387ac4142b7f540de0d586555
SHA256 4f78a7e0d8ab78d7e76a00d81f4af2d634e7b48c1c82cb44539a0178f50add86
SHA512 8466fb50a185bda1fdc35126748a81a54d9a804f7023531dd205a18e157931fcbfcf33e006ad1e7cab5288624b8816f54758fb74cc5190f263d208e32a694216

C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE

MD5 97510a7d9bf0811a6ea89fad85a9f3f3
SHA1 2ac0c49b66a92789be65580a38ae9798237711db
SHA256 c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea
SHA512 2a93e2a3bd187fdde160f87ef777ccd1d1c398d547b7c869e6b64469b9418ad04d887cdfe94af7407476377bf2d009f576de3935c025b7aefbab26fbcd8f90fb

C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE

MD5 86749cd13537a694795be5d87ef7106d
SHA1 538030845680a8be8219618daee29e368dc1e06c
SHA256 8c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5
SHA512 7b6ae20515fb6b13701df422cbb0844d26c8a98087b2758427781f0bf11eb9ec5da029096e42960bf99ddd3d4f817db6e29ac172039110df6ea92547d331db4c

C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE

MD5 07e194ce831b1846111eb6c8b176c86e
SHA1 b9c83ec3b0949cb661878fb1a8b43a073e15baf1
SHA256 d882f673ddf40a7ea6d89ce25e4ee55d94a5ef0b5403aa8d86656fd960d0e4ac
SHA512 55f9b6d3199aa60d836b6792ae55731236fb2a99c79ce8522e07e579c64eabb88fa413c02632deb87a361dd8490361aa1424beed2e01ba28be220f8c676a1bb5

C:\Users\ALLUSE~1\PACKAG~1\{61087~1\VCREDI~1.EXE

MD5 9597098cfbc45fae685d9480d135ed13
SHA1 84401f03a7942a7e4fcd26e4414b227edd9b0f09
SHA256 45966655baaed42df92cd6d8094b4172c0e7a0320528b59cf63fca7c25d66e9c
SHA512 16afbdffe4b4b2e54b4cc96fe74e49ca367dea50752321ddf334756519812ba8ce147ef5459e421dc42e103bc3456aab1d185588cc86b35fa2315ac86b2a0164

C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE

MD5 87f15006aea3b4433e226882a56f188d
SHA1 e3ad6beb8229af62b0824151dbf546c0506d4f65
SHA256 8d0045c74270281c705009d49441167c8a51ac70b720f84ff941b39fad220919
SHA512 b01a8af6dc836044d2adc6828654fa7a187c3f7ffe2a4db4c73021be6d121f9c1c47b1643513c3f25c0e1b5123b8ce2dc78b2ca8ce638a09c2171f158762c7c1

C:\Users\ALLUSE~1\PACKAG~1\{57A73~1\VC_RED~1.EXE

MD5 9c10a5ec52c145d340df7eafdb69c478
SHA1 57f3d99e41d123ad5f185fc21454367a7285db42
SHA256 ccf37e88447a7afdb0ba4351b8c5606dbb05b984fb133194d71bcc00d7be4e36
SHA512 2704cfd1a708bfca6db7c52467d3abf0b09313db0cdd1ea8e5d48504c8240c4bf24e677f17c5df9e3ac1f6a678e0328e73e951dc4481f35027cb03b2966dc38f

memory/1124-115-0x00000000024B0000-0x00000000024EE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp

MD5 6f8d75bb9f78720a136ffaf0ddef4278
SHA1 179ebbf8d012c53d2c2c31537fec5dfba2a6318e
SHA256 e7ec704c8f67a59cee58558641e1f360b9ca6afd976f79ee5300299c81f27d9f
SHA512 00d51288d5d699de7765ea91bce52acd0ecd047bacd08ed213ac7c34add237531aca085dc19f33e6f92940c82b40942590f73c2f0addc53386ff3974e2c48220

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-01 17:57

Reported

2022-10-01 18:09

Platform

win10v2004-20220812-en

Max time kernel

169s

Max time network

174s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A

Neshta

persistence spyware neshta

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3582-490\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\3582-490\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2288 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe C:\Users\Admin\AppData\Local\Temp\3582-490\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe
PID 2288 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe C:\Users\Admin\AppData\Local\Temp\3582-490\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe
PID 2288 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe C:\Users\Admin\AppData\Local\Temp\3582-490\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe
PID 4940 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe C:\Windows\svchost.com
PID 4940 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe C:\Windows\svchost.com
PID 4940 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe C:\Windows\svchost.com
PID 2404 wrote to memory of 3176 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\TEAMVI~1\Version7\TEAMVI~1.EXE
PID 2404 wrote to memory of 3176 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\TEAMVI~1\Version7\TEAMVI~1.EXE
PID 2404 wrote to memory of 3176 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\TEAMVI~1\Version7\TEAMVI~1.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe

"C:\Users\Admin\AppData\Local\Temp\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\TEAMVI~1\Version7\TEAMVI~1.EXE"

C:\Users\Admin\AppData\Local\Temp\TEAMVI~1\Version7\TEAMVI~1.EXE

C:\Users\Admin\AppData\Local\Temp\TEAMVI~1\Version7\TEAMVI~1.EXE

Network

Country Destination Domain Proto
US 52.168.117.170:443 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 204.79.197.200:443 tcp
US 204.79.197.200:443 tcp
US 93.184.220.29:80 tcp

Files

memory/4940-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe

MD5 ebc35ee0fb935102508f8d093de5dc75
SHA1 b499084cd5d95e3c1ece0616eab6c593c1049e8d
SHA256 0f5f032332f7c343f0d8dfa9561a18b44da8106bac9885feac44fa83e35066d7
SHA512 fc6e96d5addee2c682b0ad4632378aacee909d40e60182353f01c120bdd6d2a97ca9c0afc8ebb0e668535fdd9d658ddff262a9d253324c3cfca1b3053abae1f9

C:\Users\Admin\AppData\Local\Temp\3582-490\b00ff2a223cf00349847087edc1eda231db103625426c732047d10bffaa11ced.exe

MD5 ebc35ee0fb935102508f8d093de5dc75
SHA1 b499084cd5d95e3c1ece0616eab6c593c1049e8d
SHA256 0f5f032332f7c343f0d8dfa9561a18b44da8106bac9885feac44fa83e35066d7
SHA512 fc6e96d5addee2c682b0ad4632378aacee909d40e60182353f01c120bdd6d2a97ca9c0afc8ebb0e668535fdd9d658ddff262a9d253324c3cfca1b3053abae1f9

memory/4940-135-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsh9914.tmp\TvGetVersion.dll

MD5 b7641fc2d6eb0b3d81347d4936ced0bd
SHA1 f05955337fbb1dd1974021927a8c07fefae6637b
SHA256 681cb2b67e87915f37b6f716d53626b939d534c0c3e5e9810ad025760c798270
SHA512 f7f006a7855beaaecd0159b7e4bc2d2cd6d8b1bceb1f1f2b4e73382d34aa07cbf9c3cfadd882fe79c6b971143b04fb02410ede77c7c89b429068207d3d7ddb0a

memory/2404-137-0x0000000000000000-mapping.dmp

C:\Windows\svchost.com

MD5 ea97b5948b7a39ed51b27366433b14bf
SHA1 431862a792c40d11fc200af3191358768df1a50d
SHA256 9bb8da63d146a60cc76c7aa73a1e31fcaac703968cd765ce261886ed6ee26b0b
SHA512 cb2941639617317627b1c5a3cd01b24af547b9b05e0cef39638a5d0faf2037fd884e7930b7522aed67f7b56954a64cf57a76df2c6179c7dbfcbae063da133a46

C:\Windows\svchost.com

MD5 ea97b5948b7a39ed51b27366433b14bf
SHA1 431862a792c40d11fc200af3191358768df1a50d
SHA256 9bb8da63d146a60cc76c7aa73a1e31fcaac703968cd765ce261886ed6ee26b0b
SHA512 cb2941639617317627b1c5a3cd01b24af547b9b05e0cef39638a5d0faf2037fd884e7930b7522aed67f7b56954a64cf57a76df2c6179c7dbfcbae063da133a46

C:\Users\Admin\AppData\Local\Temp\TEAMVI~1\Version7\TEAMVI~1.EXE

MD5 a971db0e311901bc928f1acb15ed710c
SHA1 00060089e8de815cf9ed2ebe883ccb2b3a171efd
SHA256 810bd053018dd55f8a54e364f03ae6522f037e95328573428012b28c799e1ee4
SHA512 88e7c74fa772a74a2974c311492c7f3ac2690740f53006a2a9dabdbfc0e85b13663edac12b230764c6acecfb49d6238fea77dda4ed8abd4e62bd7f715276dfc9

memory/4940-141-0x0000000000400000-0x000000000043E000-memory.dmp

memory/3176-142-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\TeamViewer\Version7\TeamViewer_.exe

MD5 a971db0e311901bc928f1acb15ed710c
SHA1 00060089e8de815cf9ed2ebe883ccb2b3a171efd
SHA256 810bd053018dd55f8a54e364f03ae6522f037e95328573428012b28c799e1ee4
SHA512 88e7c74fa772a74a2974c311492c7f3ac2690740f53006a2a9dabdbfc0e85b13663edac12b230764c6acecfb49d6238fea77dda4ed8abd4e62bd7f715276dfc9

C:\Users\Admin\AppData\Local\Temp\nsaACDC.tmp\TvGetVersion.dll

MD5 54a82ad8fe612b1bfe5dc7406d1bd0b5
SHA1 02f1ebb115ef64fe54ca2d1787b04119f05afff6
SHA256 80c4332936d17604a2327ae7575fd8553219bd06a35c055ff9f0face1a7a5d59
SHA512 c2d00a87ecb5f4ec6e3862d0864f124bc77f95ec45a4b76fabb640a437ea1903a37f4ed123aefb39b54122329c85bde505dd3dded452c319a11ba2b5990001fe

C:\Users\Admin\AppData\Local\Temp\nsaACDC.tmp\TvGetVersion.dll

MD5 54a82ad8fe612b1bfe5dc7406d1bd0b5
SHA1 02f1ebb115ef64fe54ca2d1787b04119f05afff6
SHA256 80c4332936d17604a2327ae7575fd8553219bd06a35c055ff9f0face1a7a5d59
SHA512 c2d00a87ecb5f4ec6e3862d0864f124bc77f95ec45a4b76fabb640a437ea1903a37f4ed123aefb39b54122329c85bde505dd3dded452c319a11ba2b5990001fe

C:\Users\Admin\AppData\Local\Temp\nsaACDC.tmp\System.dll

MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

C:\Users\Admin\AppData\Local\Temp\nsaACDC.tmp\UserInfo.dll

MD5 c7ce0e47c83525983fd2c4c9566b4aad
SHA1 38b7ad7bb32ffae35540fce373b8a671878dc54e
SHA256 6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae
SHA512 ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e

C:\Users\Admin\AppData\Local\Temp\nsaACDC.tmp\UserInfo.dll

MD5 c7ce0e47c83525983fd2c4c9566b4aad
SHA1 38b7ad7bb32ffae35540fce373b8a671878dc54e
SHA256 6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae
SHA512 ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e

C:\Users\Admin\AppData\Local\Temp\nsaACDC.tmp\TvGetVersion.dll

MD5 54a82ad8fe612b1bfe5dc7406d1bd0b5
SHA1 02f1ebb115ef64fe54ca2d1787b04119f05afff6
SHA256 80c4332936d17604a2327ae7575fd8553219bd06a35c055ff9f0face1a7a5d59
SHA512 c2d00a87ecb5f4ec6e3862d0864f124bc77f95ec45a4b76fabb640a437ea1903a37f4ed123aefb39b54122329c85bde505dd3dded452c319a11ba2b5990001fe

C:\Users\Admin\AppData\Local\Temp\nsaACDC.tmp\InstallOptions.dll

MD5 89351a0a6a89519c86c5531e20dab9ea
SHA1 9e801aaaae9e70d8f7fc52f6f12cedc55e4c8a00
SHA256 f530069ef87a1c163c4fd63a3d5b053420ce3d7a98739c70211b4a99f90d6277
SHA512 13168fa828b581383e5f64d3b54be357e98d2eb9362b45685e7426ffc2f0696ab432cc8a3f374ce8abd03c096f1662d954877afa886fc4aa74709e6044b75c08

C:\odt\OFFICE~1.EXE

MD5 02c3d242fe142b0eabec69211b34bc55
SHA1 ea0a4a6d6078b362f7b3a4ad1505ce49957dc16e
SHA256 2a1ed24be7e3859b46ec3ebc316789ead5f12055853f86a9656e04b4bb771842
SHA512 0efb08492eaaa2e923beddc21566e98fbbef3a102f9415ff310ec616f5c84fd2ba3a7025b05e01c0bdf37e5e2f64dfd845f9254a376144cc7d827e7577dbb099