Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
56s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 11:57
Behavioral task
behavioral1
Sample
687b016dfc310bd16a904c80ceeeae50_NEAS.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
687b016dfc310bd16a904c80ceeeae50_NEAS.exe
Resource
win10v2004-20240419-en
General
-
Target
687b016dfc310bd16a904c80ceeeae50_NEAS.exe
-
Size
1.5MB
-
MD5
687b016dfc310bd16a904c80ceeeae50
-
SHA1
34ae9d20ef3b530e84b974c07d32b8da80c6c8b0
-
SHA256
eee3f871fddd2258ff1d10853ef4f0e1be8f253e53448415edea1b48ca7086f2
-
SHA512
dc3f445ec8397888094ef7c2cc68031f6a93291e2bcb50114d9aed9d9e9f3dfc8d01f3772b48d425353e0f1cc8fd67848d38e9aa0f604a918e286d04e444e595
-
SSDEEP
49152:t6ZlrP337uzHnA6cXnHvRjk9HWq0f+444444n:ylrP337uzHnA6cHI2/+444444n
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral2/files/0x000c000000023bc2-17.dat family_neshta behavioral2/files/0x000a000000023bc9-25.dat family_neshta behavioral2/memory/1336-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3256-41-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/396-42-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1128-46-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/380-54-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2928-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4916-66-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3060-70-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2992-78-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4976-82-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x0004000000020377-91.dat family_neshta behavioral2/files/0x000600000002024a-95.dat family_neshta behavioral2/files/0x0006000000020261-114.dat family_neshta behavioral2/files/0x000400000002033d-113.dat family_neshta behavioral2/files/0x00010000000202c3-112.dat family_neshta behavioral2/memory/4056-125-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x000400000002037c-111.dat family_neshta behavioral2/memory/3172-109-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x0001000000020259-101.dat family_neshta behavioral2/memory/1872-126-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4720-137-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2844-148-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4152-138-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2248-152-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2872-159-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x0002000000021562-164.dat family_neshta behavioral2/files/0x0002000000021516-181.dat family_neshta behavioral2/files/0x0008000000021510-176.dat family_neshta behavioral2/files/0x000200000002150e-175.dat family_neshta behavioral2/files/0x0001000000022fc4-195.dat family_neshta behavioral2/files/0x0001000000022fc6-194.dat family_neshta behavioral2/files/0x0001000000022f85-193.dat family_neshta behavioral2/files/0x0001000000022f88-192.dat family_neshta behavioral2/memory/3836-211-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2496-220-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x0001000000022f87-184.dat family_neshta behavioral2/memory/4804-233-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2532-242-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1628-261-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1916-270-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/5104-274-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4880-281-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1236-287-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1652-289-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3252-295-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3776-297-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3820-303-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4348-305-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/712-311-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2372-313-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4204-319-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/752-321-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/624-327-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4304-329-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4756-335-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3880-342-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1088-343-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3772-350-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4572-351-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/5004-358-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4508-359-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2080-361-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687b016dfc310bd16a904c80ceeeae50_NEAS.exe Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 687B01~1.EXE -
Executes dropped EXE 64 IoCs
pid Process 4452 687b016dfc310bd16a904c80ceeeae50_NEAS.exe 1924 svchost.exe 1464 687b016dfc310bd16a904c80ceeeae50_NEAS.exe 4740 svchost.exe 1336 svchost.com 3256 687B01~1.EXE 396 svchost.com 1128 687B01~1.EXE 380 svchost.com 2928 687B01~1.EXE 4916 svchost.com 3060 687B01~1.EXE 2992 svchost.com 4976 687B01~1.EXE 3172 svchost.com 4056 687B01~1.EXE 1872 svchost.com 4720 687B01~1.EXE 4152 svchost.com 2844 687B01~1.EXE 2248 svchost.com 2872 687B01~1.EXE 3836 svchost.com 2496 687B01~1.EXE 4804 svchost.com 2532 687B01~1.EXE 1628 svchost.com 1916 687B01~1.EXE 5104 svchost.com 4880 687B01~1.EXE 1236 svchost.com 1652 687B01~1.EXE 3252 svchost.com 3776 687B01~1.EXE 3820 svchost.com 4348 687B01~1.EXE 712 svchost.com 2372 687B01~1.EXE 4204 svchost.com 752 687B01~1.EXE 624 svchost.com 4304 687B01~1.EXE 4756 svchost.com 3880 687B01~1.EXE 1088 svchost.com 3772 687B01~1.EXE 4572 svchost.com 5004 687B01~1.EXE 4508 svchost.com 2080 687B01~1.EXE 3792 svchost.com 2628 687B01~1.EXE 2460 svchost.com 2680 687B01~1.EXE 3540 svchost.com 3232 687B01~1.EXE 3592 svchost.com 552 687B01~1.EXE 3584 svchost.com 696 687B01~1.EXE 2948 svchost.com 3332 687B01~1.EXE 2508 svchost.com 3580 687B01~1.EXE -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 687b016dfc310bd16a904c80ceeeae50_NEAS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe svchost.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\chrmstp.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13185~1.29\MICROS~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\chrome_pwa_launcher.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 687b016dfc310bd16a904c80ceeeae50_NEAS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe svchost.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 687B01~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 687B01~1.EXE File opened for modification C:\Windows\svchost.com 687B01~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 687B01~1.EXE File opened for modification C:\Windows\svchost.com 687B01~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 687B01~1.EXE File opened for modification C:\Windows\svchost.com 687B01~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 687B01~1.EXE File opened for modification C:\Windows\svchost.com 687B01~1.EXE File opened for modification C:\Windows\directx.sys 687B01~1.EXE File opened for modification C:\Windows\svchost.com 687B01~1.EXE File opened for modification C:\Windows\svchost.com 687B01~1.EXE File opened for modification C:\Windows\svchost.com 687B01~1.EXE File opened for modification C:\Windows\svchost.com 687B01~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 687B01~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 687B01~1.EXE File opened for modification C:\Windows\svchost.com 687B01~1.EXE File opened for modification C:\Windows\svchost.com 687B01~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 687B01~1.EXE File opened for modification C:\Windows\svchost.com 687B01~1.EXE File opened for modification C:\Windows\directx.sys 687B01~1.EXE File opened for modification C:\Windows\svchost.com 687B01~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 687B01~1.EXE File opened for modification C:\Windows\directx.sys 687B01~1.EXE File opened for modification C:\Windows\svchost.com 687B01~1.EXE File opened for modification C:\Windows\svchost.com 687B01~1.EXE File opened for modification C:\Windows\svchost.com 687B01~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 687B01~1.EXE File opened for modification C:\Windows\directx.sys 687B01~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 687B01~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 687B01~1.EXE File opened for modification C:\Windows\directx.sys 687B01~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 687B01~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 687B01~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 687B01~1.EXE File opened for modification C:\Windows\directx.sys 687B01~1.EXE File opened for modification C:\Windows\directx.sys svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687b016dfc310bd16a904c80ceeeae50_NEAS.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 687B01~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2516 wrote to memory of 4452 2516 687b016dfc310bd16a904c80ceeeae50_NEAS.exe 83 PID 2516 wrote to memory of 4452 2516 687b016dfc310bd16a904c80ceeeae50_NEAS.exe 83 PID 2516 wrote to memory of 4452 2516 687b016dfc310bd16a904c80ceeeae50_NEAS.exe 83 PID 4452 wrote to memory of 1924 4452 687b016dfc310bd16a904c80ceeeae50_NEAS.exe 84 PID 4452 wrote to memory of 1924 4452 687b016dfc310bd16a904c80ceeeae50_NEAS.exe 84 PID 4452 wrote to memory of 1924 4452 687b016dfc310bd16a904c80ceeeae50_NEAS.exe 84 PID 1924 wrote to memory of 1464 1924 svchost.exe 85 PID 1924 wrote to memory of 1464 1924 svchost.exe 85 PID 1924 wrote to memory of 1464 1924 svchost.exe 85 PID 1464 wrote to memory of 1336 1464 687b016dfc310bd16a904c80ceeeae50_NEAS.exe 87 PID 1464 wrote to memory of 1336 1464 687b016dfc310bd16a904c80ceeeae50_NEAS.exe 87 PID 1464 wrote to memory of 1336 1464 687b016dfc310bd16a904c80ceeeae50_NEAS.exe 87 PID 1336 wrote to memory of 3256 1336 svchost.com 88 PID 1336 wrote to memory of 3256 1336 svchost.com 88 PID 1336 wrote to memory of 3256 1336 svchost.com 88 PID 3256 wrote to memory of 396 3256 687B01~1.EXE 89 PID 3256 wrote to memory of 396 3256 687B01~1.EXE 89 PID 3256 wrote to memory of 396 3256 687B01~1.EXE 89 PID 396 wrote to memory of 1128 396 svchost.com 90 PID 396 wrote to memory of 1128 396 svchost.com 90 PID 396 wrote to memory of 1128 396 svchost.com 90 PID 1128 wrote to memory of 380 1128 687B01~1.EXE 91 PID 1128 wrote to memory of 380 1128 687B01~1.EXE 91 PID 1128 wrote to memory of 380 1128 687B01~1.EXE 91 PID 380 wrote to memory of 2928 380 svchost.com 92 PID 380 wrote to memory of 2928 380 svchost.com 92 PID 380 wrote to memory of 2928 380 svchost.com 92 PID 2928 wrote to memory of 4916 2928 687B01~1.EXE 93 PID 2928 wrote to memory of 4916 2928 687B01~1.EXE 93 PID 2928 wrote to memory of 4916 2928 687B01~1.EXE 93 PID 4916 wrote to memory of 3060 4916 svchost.com 94 PID 4916 wrote to memory of 3060 4916 svchost.com 94 PID 4916 wrote to memory of 3060 4916 svchost.com 94 PID 3060 wrote to memory of 2992 3060 687B01~1.EXE 95 PID 3060 wrote to memory of 2992 3060 687B01~1.EXE 95 PID 3060 wrote to memory of 2992 3060 687B01~1.EXE 95 PID 2992 wrote to memory of 4976 2992 svchost.com 185 PID 2992 wrote to memory of 4976 2992 svchost.com 185 PID 2992 wrote to memory of 4976 2992 svchost.com 185 PID 4976 wrote to memory of 3172 4976 687B01~1.EXE 97 PID 4976 wrote to memory of 3172 4976 687B01~1.EXE 97 PID 4976 wrote to memory of 3172 4976 687B01~1.EXE 97 PID 3172 wrote to memory of 4056 3172 svchost.com 186 PID 3172 wrote to memory of 4056 3172 svchost.com 186 PID 3172 wrote to memory of 4056 3172 svchost.com 186 PID 4056 wrote to memory of 1872 4056 687B01~1.EXE 99 PID 4056 wrote to memory of 1872 4056 687B01~1.EXE 99 PID 4056 wrote to memory of 1872 4056 687B01~1.EXE 99 PID 1872 wrote to memory of 4720 1872 svchost.com 100 PID 1872 wrote to memory of 4720 1872 svchost.com 100 PID 1872 wrote to memory of 4720 1872 svchost.com 100 PID 4720 wrote to memory of 4152 4720 687B01~1.EXE 101 PID 4720 wrote to memory of 4152 4720 687B01~1.EXE 101 PID 4720 wrote to memory of 4152 4720 687B01~1.EXE 101 PID 4152 wrote to memory of 2844 4152 svchost.com 163 PID 4152 wrote to memory of 2844 4152 svchost.com 163 PID 4152 wrote to memory of 2844 4152 svchost.com 163 PID 2844 wrote to memory of 2248 2844 687B01~1.EXE 103 PID 2844 wrote to memory of 2248 2844 687B01~1.EXE 103 PID 2844 wrote to memory of 2248 2844 687B01~1.EXE 103 PID 2248 wrote to memory of 2872 2248 svchost.com 229 PID 2248 wrote to memory of 2872 2248 svchost.com 229 PID 2248 wrote to memory of 2872 2248 svchost.com 229 PID 2872 wrote to memory of 3836 2872 687B01~1.EXE 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\687b016dfc310bd16a904c80ceeeae50_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\687b016dfc310bd16a904c80ceeeae50_NEAS.exe"1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687b016dfc310bd16a904c80ceeeae50_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\687b016dfc310bd16a904c80ceeeae50_NEAS.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\687b016dfc310bd16a904c80ceeeae50_NEAS.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687b016dfc310bd16a904c80ceeeae50_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\687b016dfc310bd16a904c80ceeeae50_NEAS.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE14⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE20⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"23⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:2496 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"25⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE26⤵
- Executes dropped EXE
PID:2532 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"27⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE28⤵
- Executes dropped EXE
PID:1916 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"29⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE30⤵
- Executes dropped EXE
PID:4880 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"31⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE32⤵
- Checks computer location settings
- Executes dropped EXE
PID:1652 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"33⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE34⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:3776 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"35⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE36⤵
- Executes dropped EXE
PID:4348 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"37⤵
- Executes dropped EXE
PID:712 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE38⤵
- Executes dropped EXE
PID:2372 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"39⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE40⤵
- Executes dropped EXE
PID:752 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"41⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE42⤵
- Executes dropped EXE
PID:4304 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"43⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE44⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3880 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"45⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE46⤵
- Checks computer location settings
- Executes dropped EXE
PID:3772 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"47⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE48⤵
- Executes dropped EXE
- Modifies registry class
PID:5004 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"49⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE50⤵
- Executes dropped EXE
PID:2080 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"51⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE52⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:2628 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"53⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE54⤵
- Executes dropped EXE
PID:2680 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"55⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE56⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3232 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"57⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE58⤵
- Executes dropped EXE
PID:552 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"59⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE60⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:696 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"61⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE62⤵
- Executes dropped EXE
PID:3332 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"63⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE64⤵
- Executes dropped EXE
PID:3580 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"65⤵
- Drops file in Windows directory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE66⤵PID:3464
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"67⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE68⤵PID:4520
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"69⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE70⤵
- Drops file in Windows directory
PID:3248 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"71⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE72⤵
- Checks computer location settings
- Drops file in Windows directory
PID:4044 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"73⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE74⤵PID:4272
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"75⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE76⤵
- Drops file in Windows directory
PID:2692 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"77⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE78⤵
- Drops file in Windows directory
- Modifies registry class
PID:2872 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"79⤵
- Drops file in Windows directory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE80⤵PID:4616
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"81⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE82⤵PID:3280
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"83⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE84⤵
- Checks computer location settings
- Drops file in Windows directory
PID:4460 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"85⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE86⤵
- Checks computer location settings
PID:376 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"87⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE88⤵
- Checks computer location settings
PID:832 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"89⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE90⤵
- Modifies registry class
PID:1392 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"91⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE92⤵PID:404
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"93⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE94⤵
- Checks computer location settings
PID:2428 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"95⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE96⤵PID:4976
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"97⤵
- Drops file in Windows directory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE98⤵
- Checks computer location settings
PID:5064 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"99⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE100⤵PID:1080
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"101⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE102⤵
- Checks computer location settings
- Modifies registry class
PID:4044 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"103⤵
- Drops file in Windows directory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE104⤵PID:1260
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"105⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE106⤵PID:1964
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"107⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE108⤵
- Checks computer location settings
PID:4260 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"109⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE110⤵
- Checks computer location settings
PID:1788 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"111⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE112⤵
- Modifies registry class
PID:3872 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"113⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE114⤵
- Modifies registry class
PID:4932 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"115⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE116⤵PID:4884
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"117⤵
- Drops file in Windows directory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE118⤵
- Checks computer location settings
PID:2396 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"119⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE120⤵PID:1428
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE"121⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\687B01~1.EXE122⤵
- Modifies registry class
PID:920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-