Analysis
-
max time kernel
146s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
10/10/2024, 19:14
Behavioral task
behavioral1
Sample
f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe
Resource
win7-20240729-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe
-
Size
314KB
-
MD5
d0102ba2c59700add4cdcdbed01e165b
-
SHA1
fb3a0505fcd26190c782a048ef665196a1e33084
-
SHA256
f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674
-
SHA512
e2603298bba575c79f21a5f50dd029ad99c0aa6fb772af5facc374719b042cd23552fa0aa01de4111c22d086920f3375c8478e901d65047b5e9f222bed3218c0
-
SSDEEP
6144:k9OeySe8AIqpoHbnDns1ND97deKzC/IUeRUqGntyH7xOc6H5c6HcT66vlmrq:QyV8hEoHbI3x/+eSaH
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x000700000001956c-23.dat family_neshta behavioral1/files/0x000600000001958e-33.dat family_neshta behavioral1/files/0x000100000001064f-35.dat family_neshta behavioral1/files/0x0001000000010319-37.dat family_neshta behavioral1/files/0x0001000000010317-36.dat family_neshta behavioral1/memory/2776-51-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2360-50-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000b000000010326-34.dat family_neshta behavioral1/memory/2660-67-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1084-66-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2332-95-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1740-94-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1476-109-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2984-108-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3004-123-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/432-149-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2060-148-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2292-169-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2228-170-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2216-183-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2208-184-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2168-203-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2280-202-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1764-212-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2420-211-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2988-226-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1968-251-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1980-247-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2868-271-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3032-272-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2672-280-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2668-291-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1084-290-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/832-303-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2532-311-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1784-310-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1740-319-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2716-318-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2948-327-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2184-326-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1436-335-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/840-334-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2592-343-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2100-342-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2616-350-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3064-351-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2524-358-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2136-359-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2276-367-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2012-375-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1596-383-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1092-382-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2440-391-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2124-390-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2280-399-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2612-398-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1032-407-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/980-406-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2240-374-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2428-415-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2264-414-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3056-366-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2928-302-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2844-279-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
pid Process 3032 f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe 2800 svchost.exe 2852 f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe 2776 svchost.com 2976 svchost.exe 2360 F12ADC~1.EXE 2660 svchost.com 1084 F12ADC~1.EXE 2132 svchost.com 752 F12ADC~1.EXE 2332 svchost.com 1740 F12ADC~1.EXE 1476 svchost.com 2984 F12ADC~1.EXE 3004 svchost.com 276 F12ADC~1.EXE 2060 svchost.com 432 F12ADC~1.EXE 2228 svchost.com 2292 F12ADC~1.EXE 2208 svchost.com 2216 F12ADC~1.EXE 2168 svchost.com 2280 F12ADC~1.EXE 1764 svchost.com 2420 F12ADC~1.EXE 2988 svchost.com 2568 F12ADC~1.EXE 1968 svchost.com 1980 F12ADC~1.EXE 3032 svchost.com 2868 F12ADC~1.EXE 2672 svchost.com 2844 F12ADC~1.EXE 2668 svchost.com 1084 F12ADC~1.EXE 2928 svchost.com 832 F12ADC~1.EXE 2532 svchost.com 1784 F12ADC~1.EXE 1740 svchost.com 2716 F12ADC~1.EXE 2948 svchost.com 2184 F12ADC~1.EXE 840 svchost.com 1436 F12ADC~1.EXE 2100 svchost.com 2592 F12ADC~1.EXE 3064 svchost.com 2616 F12ADC~1.EXE 2524 svchost.com 2136 F12ADC~1.EXE 3056 svchost.com 2276 F12ADC~1.EXE 2240 svchost.com 2012 F12ADC~1.EXE 1596 svchost.com 1092 F12ADC~1.EXE 2440 svchost.com 2124 F12ADC~1.EXE 2280 svchost.com 2612 F12ADC~1.EXE 1032 svchost.com 980 F12ADC~1.EXE -
Loads dropped DLL 64 IoCs
pid Process 2116 f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe 2116 f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe 2800 svchost.exe 2800 svchost.exe 2776 svchost.com 2776 svchost.com 2660 svchost.com 2660 svchost.com 2132 svchost.com 2132 svchost.com 2332 svchost.com 2332 svchost.com 1476 svchost.com 1476 svchost.com 3004 svchost.com 3004 svchost.com 2060 svchost.com 2060 svchost.com 2852 f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe 2116 f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe 2852 f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe 2228 svchost.com 2228 svchost.com 2208 svchost.com 2208 svchost.com 2168 svchost.com 2168 svchost.com 1764 svchost.com 1764 svchost.com 2988 svchost.com 2988 svchost.com 1968 svchost.com 1968 svchost.com 3032 svchost.com 3032 svchost.com 2116 f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe 2672 svchost.com 2672 svchost.com 2668 svchost.com 2668 svchost.com 2928 svchost.com 2928 svchost.com 2532 svchost.com 2532 svchost.com 1740 svchost.com 1740 svchost.com 2948 svchost.com 2948 svchost.com 840 svchost.com 840 svchost.com 2100 svchost.com 2100 svchost.com 3064 svchost.com 3064 svchost.com 2524 svchost.com 2524 svchost.com 3056 svchost.com 3056 svchost.com 2240 svchost.com 2240 svchost.com 1596 svchost.com 1596 svchost.com 2440 svchost.com 2440 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe svchost.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\Program Files\SuspendCompare.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys F12ADC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com F12ADC~1.EXE File opened for modification C:\Windows\directx.sys F12ADC~1.EXE File opened for modification C:\Windows\svchost.com F12ADC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys F12ADC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys F12ADC~1.EXE File opened for modification C:\Windows\directx.sys F12ADC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys F12ADC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys F12ADC~1.EXE File opened for modification C:\Windows\directx.sys F12ADC~1.EXE File opened for modification C:\Windows\svchost.com F12ADC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys F12ADC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys F12ADC~1.EXE File opened for modification C:\Windows\svchost.com F12ADC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys F12ADC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys F12ADC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys F12ADC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com F12ADC~1.EXE File opened for modification C:\Windows\svchost.com F12ADC~1.EXE File opened for modification C:\Windows\svchost.com F12ADC~1.EXE File opened for modification C:\Windows\svchost.com F12ADC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com F12ADC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys F12ADC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys F12ADC~1.EXE File opened for modification C:\Windows\svchost.com F12ADC~1.EXE File opened for modification C:\Windows\directx.sys F12ADC~1.EXE File opened for modification C:\Windows\directx.sys F12ADC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com F12ADC~1.EXE File opened for modification C:\Windows\svchost.com F12ADC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12ADC~1.EXE -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 3032 2116 f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe 59 PID 2116 wrote to memory of 3032 2116 f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe 59 PID 2116 wrote to memory of 3032 2116 f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe 59 PID 2116 wrote to memory of 3032 2116 f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe 59 PID 3032 wrote to memory of 2800 3032 f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe 30 PID 3032 wrote to memory of 2800 3032 f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe 30 PID 3032 wrote to memory of 2800 3032 f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe 30 PID 3032 wrote to memory of 2800 3032 f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe 30 PID 2800 wrote to memory of 2852 2800 svchost.exe 31 PID 2800 wrote to memory of 2852 2800 svchost.exe 31 PID 2800 wrote to memory of 2852 2800 svchost.exe 31 PID 2800 wrote to memory of 2852 2800 svchost.exe 31 PID 2852 wrote to memory of 2776 2852 f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe 32 PID 2852 wrote to memory of 2776 2852 f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe 32 PID 2852 wrote to memory of 2776 2852 f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe 32 PID 2852 wrote to memory of 2776 2852 f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe 32 PID 2776 wrote to memory of 2360 2776 svchost.com 105 PID 2776 wrote to memory of 2360 2776 svchost.com 105 PID 2776 wrote to memory of 2360 2776 svchost.com 105 PID 2776 wrote to memory of 2360 2776 svchost.com 105 PID 2360 wrote to memory of 2660 2360 F12ADC~1.EXE 35 PID 2360 wrote to memory of 2660 2360 F12ADC~1.EXE 35 PID 2360 wrote to memory of 2660 2360 F12ADC~1.EXE 35 PID 2360 wrote to memory of 2660 2360 F12ADC~1.EXE 35 PID 2660 wrote to memory of 1084 2660 svchost.com 64 PID 2660 wrote to memory of 1084 2660 svchost.com 64 PID 2660 wrote to memory of 1084 2660 svchost.com 64 PID 2660 wrote to memory of 1084 2660 svchost.com 64 PID 1084 wrote to memory of 2132 1084 F12ADC~1.EXE 37 PID 1084 wrote to memory of 2132 1084 F12ADC~1.EXE 37 PID 1084 wrote to memory of 2132 1084 F12ADC~1.EXE 37 PID 1084 wrote to memory of 2132 1084 F12ADC~1.EXE 37 PID 2132 wrote to memory of 752 2132 svchost.com 38 PID 2132 wrote to memory of 752 2132 svchost.com 38 PID 2132 wrote to memory of 752 2132 svchost.com 38 PID 2132 wrote to memory of 752 2132 svchost.com 38 PID 752 wrote to memory of 2332 752 F12ADC~1.EXE 39 PID 752 wrote to memory of 2332 752 F12ADC~1.EXE 39 PID 752 wrote to memory of 2332 752 F12ADC~1.EXE 39 PID 752 wrote to memory of 2332 752 F12ADC~1.EXE 39 PID 2332 wrote to memory of 1740 2332 svchost.com 40 PID 2332 wrote to memory of 1740 2332 svchost.com 40 PID 2332 wrote to memory of 1740 2332 svchost.com 40 PID 2332 wrote to memory of 1740 2332 svchost.com 40 PID 1740 wrote to memory of 1476 1740 F12ADC~1.EXE 41 PID 1740 wrote to memory of 1476 1740 F12ADC~1.EXE 41 PID 1740 wrote to memory of 1476 1740 F12ADC~1.EXE 41 PID 1740 wrote to memory of 1476 1740 F12ADC~1.EXE 41 PID 1476 wrote to memory of 2984 1476 svchost.com 115 PID 1476 wrote to memory of 2984 1476 svchost.com 115 PID 1476 wrote to memory of 2984 1476 svchost.com 115 PID 1476 wrote to memory of 2984 1476 svchost.com 115 PID 2984 wrote to memory of 3004 2984 F12ADC~1.EXE 119 PID 2984 wrote to memory of 3004 2984 F12ADC~1.EXE 119 PID 2984 wrote to memory of 3004 2984 F12ADC~1.EXE 119 PID 2984 wrote to memory of 3004 2984 F12ADC~1.EXE 119 PID 3004 wrote to memory of 276 3004 svchost.com 44 PID 3004 wrote to memory of 276 3004 svchost.com 44 PID 3004 wrote to memory of 276 3004 svchost.com 44 PID 3004 wrote to memory of 276 3004 svchost.com 44 PID 276 wrote to memory of 2060 276 F12ADC~1.EXE 45 PID 276 wrote to memory of 2060 276 F12ADC~1.EXE 45 PID 276 wrote to memory of 2060 276 F12ADC~1.EXE 45 PID 276 wrote to memory of 2060 276 F12ADC~1.EXE 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe"C:\Users\Admin\AppData\Local\Temp\f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\3582-490\f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\3582-490\f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\f12adc8da042e58dc97e390a044284a266adad7949a177238b1d7e72e6bc4674.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE6⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:276 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE18⤵
- Executes dropped EXE
PID:432 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE20⤵
- Executes dropped EXE
PID:2292 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE22⤵
- Executes dropped EXE
PID:2216 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE24⤵
- Executes dropped EXE
PID:2280 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE26⤵
- Executes dropped EXE
PID:2420 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2568 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE30⤵
- Executes dropped EXE
PID:1980 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE32⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2868 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE34⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2844 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE36⤵
- Executes dropped EXE
PID:1084 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE38⤵
- Executes dropped EXE
PID:832 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE40⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1784 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE42⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2716 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE44⤵
- Executes dropped EXE
PID:2184 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE46⤵
- Executes dropped EXE
PID:1436 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE48⤵
- Executes dropped EXE
PID:2592 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE50⤵
- Executes dropped EXE
PID:2616 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2136 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE54⤵
- Executes dropped EXE
PID:2276 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE56⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2012 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE58⤵
- Executes dropped EXE
PID:1092 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE60⤵
- Executes dropped EXE
PID:2124 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"61⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE62⤵
- Executes dropped EXE
PID:2612 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"63⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE64⤵
- Executes dropped EXE
PID:980 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"65⤵
- Drops file in Windows directory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE66⤵PID:2264
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"67⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE68⤵
- System Location Discovery: System Language Discovery
PID:1964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"69⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE70⤵PID:3036
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"71⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE72⤵PID:3060
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"73⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE74⤵PID:2804
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"75⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE76⤵PID:2544
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"77⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE78⤵
- Drops file in Windows directory
PID:2968 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"79⤵
- System Location Discovery: System Language Discovery
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE80⤵PID:1656
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"81⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE82⤵
- System Location Discovery: System Language Discovery
PID:832 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"83⤵
- Drops file in Windows directory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE84⤵
- Drops file in Windows directory
PID:1256 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"85⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE86⤵PID:1044
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"87⤵
- Drops file in Windows directory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE88⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2948 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"89⤵
- Drops file in Windows directory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE90⤵
- System Location Discovery: System Language Discovery
PID:1048 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"91⤵
- System Location Discovery: System Language Discovery
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE92⤵
- Drops file in Windows directory
PID:1456 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"93⤵
- System Location Discovery: System Language Discovery
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE94⤵PID:1104
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"95⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE96⤵
- System Location Discovery: System Language Discovery
PID:2256 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"97⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE98⤵
- Drops file in Windows directory
PID:2200 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"99⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE100⤵PID:1012
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"101⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE102⤵PID:2248
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"103⤵
- Drops file in Windows directory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE104⤵PID:2312
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"105⤵
- System Location Discovery: System Language Discovery
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE106⤵
- Drops file in Windows directory
PID:2456 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"107⤵
- System Location Discovery: System Language Discovery
PID:544 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE108⤵PID:1032
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"109⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE110⤵PID:892
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"111⤵
- System Location Discovery: System Language Discovery
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE112⤵PID:1584
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"113⤵
- Drops file in Windows directory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE114⤵PID:2380
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"115⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE116⤵
- Drops file in Windows directory
PID:3048 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"117⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE118⤵
- System Location Discovery: System Language Discovery
PID:2944 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"119⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE120⤵PID:3032
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\F12ADC~1.EXE"121⤵PID:2652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-