Analysis
-
max time kernel
119s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
22-10-2024 17:25
Behavioral task
behavioral1
Sample
5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe
Resource
win7-20240729-en
windows7-x64
12 signatures
120 seconds
Behavioral task
behavioral2
Sample
5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
120 seconds
General
-
Target
5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe
-
Size
197KB
-
MD5
fe0d608975429428df47cdeffe476d10
-
SHA1
d5c8a79c25427dcab99f0c1acf4f826e60747849
-
SHA256
5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2
-
SHA512
a55c406636ec3117e7e8fa7bbf3bed53b045c9d510375762b591298c24ce5c124a5c02d404b863a88b5f43cff175eb4e0330c91fa0821a1f4f66a672b790c404
-
SSDEEP
3072:sr85COoPZMYGdIRhGEkxutMgYd/bcTixUvOOOOOOOOOOOOOOOOOOOOOOOOOOOOOg:k9bsERVYd/YTixUdgxrOfc29
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
Processes:
resource yara_rule behavioral1/files/0x00070000000186ca-2.dat family_neshta behavioral1/files/0x00070000000186d9-15.dat family_neshta behavioral1/files/0x0001000000010319-20.dat family_neshta behavioral1/files/0x0001000000010317-19.dat family_neshta behavioral1/files/0x000100000001064f-18.dat family_neshta behavioral1/files/0x000b000000010326-17.dat family_neshta behavioral1/memory/2352-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2892-29-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2444-45-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2928-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2668-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2688-57-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2176-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2660-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2268-95-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1956-94-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d9-97.dat family_neshta behavioral1/files/0x000100000000f7de-102.dat family_neshta behavioral1/files/0x000100000000f7ec-109.dat family_neshta behavioral1/files/0x000100000000f7d0-108.dat family_neshta behavioral1/files/0x000100000000f77c-107.dat family_neshta behavioral1/memory/2472-115-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2084-114-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f709-126.dat family_neshta behavioral1/files/0x000100000000f833-129.dat family_neshta behavioral1/files/0x000100000000f87a-136.dat family_neshta behavioral1/memory/2940-135-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2520-134-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2056-151-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1444-150-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2608-174-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2404-173-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1648-187-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2592-186-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/576-203-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2308-205-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1896-210-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2416-209-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1932-218-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1912-217-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1952-239-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2572-238-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1616-260-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1756-259-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/672-270-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2848-269-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2352-278-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2648-277-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2888-296-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2812-297-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2704-309-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2752-303-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2176-315-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/380-316-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2052-324-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1056-323-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2500-332-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2868-331-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1688-340-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1732-339-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3008-348-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1172-347-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1944-356-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1152-355-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
Processes:
5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exesvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.compid Process 1084 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe 2352 svchost.com 2892 5F73C5~1.EXE 2444 svchost.com 2928 5F73C5~1.EXE 2668 svchost.com 2688 5F73C5~1.EXE 2660 svchost.com 2176 5F73C5~1.EXE 1956 svchost.com 2268 5F73C5~1.EXE 2472 svchost.com 2084 5F73C5~1.EXE 2940 svchost.com 2520 5F73C5~1.EXE 1444 svchost.com 2056 5F73C5~1.EXE 2608 svchost.com 2404 5F73C5~1.EXE 1648 svchost.com 2592 5F73C5~1.EXE 576 svchost.com 2308 5F73C5~1.EXE 1896 svchost.com 2416 5F73C5~1.EXE 1932 svchost.com 1912 5F73C5~1.EXE 1952 svchost.com 2572 5F73C5~1.EXE 1756 svchost.com 1616 5F73C5~1.EXE 672 svchost.com 2848 5F73C5~1.EXE 2352 svchost.com 2648 5F73C5~1.EXE 2888 svchost.com 2812 5F73C5~1.EXE 2752 svchost.com 2704 5F73C5~1.EXE 380 svchost.com 2176 5F73C5~1.EXE 2052 svchost.com 1056 5F73C5~1.EXE 2500 svchost.com 2868 5F73C5~1.EXE 1688 svchost.com 1732 5F73C5~1.EXE 3008 svchost.com 1172 5F73C5~1.EXE 1944 svchost.com 1152 5F73C5~1.EXE 3040 svchost.com 964 5F73C5~1.EXE 3044 svchost.com 2056 5F73C5~1.EXE 2060 svchost.com 2256 5F73C5~1.EXE 2820 svchost.com 3032 5F73C5~1.EXE 2596 svchost.com 2324 5F73C5~1.EXE 1228 svchost.com 1672 5F73C5~1.EXE 1720 svchost.com -
Loads dropped DLL 64 IoCs
Processes:
5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.compid Process 1744 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe 1744 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe 2352 svchost.com 2352 svchost.com 2444 svchost.com 2444 svchost.com 2668 svchost.com 2668 svchost.com 2660 svchost.com 2660 svchost.com 1956 svchost.com 1956 svchost.com 2472 svchost.com 2472 svchost.com 1084 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe 1744 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe 1744 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe 2940 svchost.com 2940 svchost.com 1084 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe 1444 svchost.com 1444 svchost.com 2608 svchost.com 2608 svchost.com 1648 svchost.com 1648 svchost.com 576 svchost.com 576 svchost.com 1896 svchost.com 1896 svchost.com 1084 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe 1932 svchost.com 1932 svchost.com 1952 svchost.com 1952 svchost.com 1084 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe 1084 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe 1756 svchost.com 1756 svchost.com 1084 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe 672 svchost.com 672 svchost.com 2352 svchost.com 2352 svchost.com 2888 svchost.com 2888 svchost.com 2752 svchost.com 2752 svchost.com 380 svchost.com 380 svchost.com 2052 svchost.com 2052 svchost.com 2500 svchost.com 2500 svchost.com 1688 svchost.com 1688 svchost.com 3008 svchost.com 3008 svchost.com 1944 svchost.com 1944 svchost.com 3040 svchost.com 3040 svchost.com 3044 svchost.com 3044 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exedescription ioc Process File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe -
Drops file in Windows directory 64 IoCs
Processes:
svchost.com5F73C5~1.EXE5F73C5~1.EXE5F73C5~1.EXEsvchost.comsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com5F73C5~1.EXE5F73C5~1.EXEsvchost.com5F73C5~1.EXE5F73C5~1.EXEsvchost.comsvchost.comsvchost.comsvchost.com5F73C5~1.EXE5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXE5F73C5~1.EXE5F73C5~1.EXEsvchost.comsvchost.comsvchost.comsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.comsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXE5F73C5~1.EXEsvchost.comsvchost.com5F73C5~1.EXE5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.comsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXE5F73C5~1.EXE5F73C5~1.EXE5F73C5~1.EXEdescription ioc Process File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 5F73C5~1.EXE File opened for modification C:\Windows\svchost.com 5F73C5~1.EXE File opened for modification C:\Windows\svchost.com 5F73C5~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 5F73C5~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 5F73C5~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 5F73C5~1.EXE File opened for modification C:\Windows\directx.sys 5F73C5~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 5F73C5~1.EXE File opened for modification C:\Windows\directx.sys 5F73C5~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 5F73C5~1.EXE File opened for modification C:\Windows\svchost.com 5F73C5~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 5F73C5~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 5F73C5~1.EXE File opened for modification C:\Windows\directx.sys 5F73C5~1.EXE File opened for modification C:\Windows\directx.sys 5F73C5~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 5F73C5~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 5F73C5~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 5F73C5~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 5F73C5~1.EXE File opened for modification C:\Windows\directx.sys 5F73C5~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 5F73C5~1.EXE File opened for modification C:\Windows\directx.sys 5F73C5~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 5F73C5~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 5F73C5~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 5F73C5~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 5F73C5~1.EXE File opened for modification C:\Windows\svchost.com 5F73C5~1.EXE File opened for modification C:\Windows\directx.sys 5F73C5~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
svchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXE5F73C5~1.EXE5F73C5~1.EXE5F73C5~1.EXEsvchost.comsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXE5F73C5~1.EXE5F73C5~1.EXE5F73C5~1.EXEsvchost.comsvchost.comsvchost.com5F73C5~1.EXE5F73C5~1.EXEsvchost.comsvchost.com5F73C5~1.EXE5F73C5~1.EXE5F73C5~1.EXE5F73C5~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com5F73C5~1.EXEsvchost.comsvchost.comsvchost.com5F73C5~1.EXE5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXE5F73C5~1.EXE5F73C5~1.EXEsvchost.com5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe5F73C5~1.EXEsvchost.com5F73C5~1.EXE5F73C5~1.EXE5F73C5~1.EXE5F73C5~1.EXEsvchost.com5F73C5~1.EXE5F73C5~1.EXE5F73C5~1.EXE5F73C5~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comdescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F73C5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
Processes:
5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exesvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEsvchost.com5F73C5~1.EXEdescription pid Process procid_target PID 1744 wrote to memory of 1084 1744 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe 29 PID 1744 wrote to memory of 1084 1744 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe 29 PID 1744 wrote to memory of 1084 1744 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe 29 PID 1744 wrote to memory of 1084 1744 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe 29 PID 1084 wrote to memory of 2352 1084 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe 30 PID 1084 wrote to memory of 2352 1084 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe 30 PID 1084 wrote to memory of 2352 1084 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe 30 PID 1084 wrote to memory of 2352 1084 5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe 30 PID 2352 wrote to memory of 2892 2352 svchost.com 31 PID 2352 wrote to memory of 2892 2352 svchost.com 31 PID 2352 wrote to memory of 2892 2352 svchost.com 31 PID 2352 wrote to memory of 2892 2352 svchost.com 31 PID 2892 wrote to memory of 2444 2892 5F73C5~1.EXE 32 PID 2892 wrote to memory of 2444 2892 5F73C5~1.EXE 32 PID 2892 wrote to memory of 2444 2892 5F73C5~1.EXE 32 PID 2892 wrote to memory of 2444 2892 5F73C5~1.EXE 32 PID 2444 wrote to memory of 2928 2444 svchost.com 33 PID 2444 wrote to memory of 2928 2444 svchost.com 33 PID 2444 wrote to memory of 2928 2444 svchost.com 33 PID 2444 wrote to memory of 2928 2444 svchost.com 33 PID 2928 wrote to memory of 2668 2928 5F73C5~1.EXE 34 PID 2928 wrote to memory of 2668 2928 5F73C5~1.EXE 34 PID 2928 wrote to memory of 2668 2928 5F73C5~1.EXE 34 PID 2928 wrote to memory of 2668 2928 5F73C5~1.EXE 34 PID 2668 wrote to memory of 2688 2668 svchost.com 35 PID 2668 wrote to memory of 2688 2668 svchost.com 35 PID 2668 wrote to memory of 2688 2668 svchost.com 35 PID 2668 wrote to memory of 2688 2668 svchost.com 35 PID 2688 wrote to memory of 2660 2688 5F73C5~1.EXE 36 PID 2688 wrote to memory of 2660 2688 5F73C5~1.EXE 36 PID 2688 wrote to memory of 2660 2688 5F73C5~1.EXE 36 PID 2688 wrote to memory of 2660 2688 5F73C5~1.EXE 36 PID 2660 wrote to memory of 2176 2660 svchost.com 69 PID 2660 wrote to memory of 2176 2660 svchost.com 69 PID 2660 wrote to memory of 2176 2660 svchost.com 69 PID 2660 wrote to memory of 2176 2660 svchost.com 69 PID 2176 wrote to memory of 1956 2176 5F73C5~1.EXE 38 PID 2176 wrote to memory of 1956 2176 5F73C5~1.EXE 38 PID 2176 wrote to memory of 1956 2176 5F73C5~1.EXE 38 PID 2176 wrote to memory of 1956 2176 5F73C5~1.EXE 38 PID 1956 wrote to memory of 2268 1956 svchost.com 39 PID 1956 wrote to memory of 2268 1956 svchost.com 39 PID 1956 wrote to memory of 2268 1956 svchost.com 39 PID 1956 wrote to memory of 2268 1956 svchost.com 39 PID 2268 wrote to memory of 2472 2268 5F73C5~1.EXE 40 PID 2268 wrote to memory of 2472 2268 5F73C5~1.EXE 40 PID 2268 wrote to memory of 2472 2268 5F73C5~1.EXE 40 PID 2268 wrote to memory of 2472 2268 5F73C5~1.EXE 40 PID 2472 wrote to memory of 2084 2472 svchost.com 41 PID 2472 wrote to memory of 2084 2472 svchost.com 41 PID 2472 wrote to memory of 2084 2472 svchost.com 41 PID 2472 wrote to memory of 2084 2472 svchost.com 41 PID 2084 wrote to memory of 2940 2084 5F73C5~1.EXE 42 PID 2084 wrote to memory of 2940 2084 5F73C5~1.EXE 42 PID 2084 wrote to memory of 2940 2084 5F73C5~1.EXE 42 PID 2084 wrote to memory of 2940 2084 5F73C5~1.EXE 42 PID 2940 wrote to memory of 2520 2940 svchost.com 43 PID 2940 wrote to memory of 2520 2940 svchost.com 43 PID 2940 wrote to memory of 2520 2940 svchost.com 43 PID 2940 wrote to memory of 2520 2940 svchost.com 43 PID 2520 wrote to memory of 1444 2520 5F73C5~1.EXE 44 PID 2520 wrote to memory of 1444 2520 5F73C5~1.EXE 44 PID 2520 wrote to memory of 1444 2520 5F73C5~1.EXE 44 PID 2520 wrote to memory of 1444 2520 5F73C5~1.EXE 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe"C:\Users\Admin\AppData\Local\Temp\5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\5f73c593edc3eaa411285100e60f3799a38964194d8e8c70e27fa41a975fadd2N.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE18⤵
- Executes dropped EXE
PID:2056 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE20⤵
- Executes dropped EXE
PID:2404 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2592 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE24⤵
- Executes dropped EXE
PID:2308 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE26⤵
- Executes dropped EXE
PID:2416 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE28⤵
- Executes dropped EXE
PID:1912 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE30⤵
- Executes dropped EXE
PID:2572 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE32⤵
- Executes dropped EXE
PID:1616 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:672 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE34⤵
- Executes dropped EXE
PID:2848 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE36⤵
- Executes dropped EXE
PID:2648 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE38⤵
- Executes dropped EXE
PID:2812 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE40⤵
- Executes dropped EXE
PID:2704 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:380 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2176 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE44⤵
- Executes dropped EXE
PID:1056 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE46⤵
- Executes dropped EXE
PID:2868 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1732 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1172 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE52⤵
- Executes dropped EXE
PID:1152 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE54⤵
- Executes dropped EXE
PID:964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE56⤵
- Executes dropped EXE
PID:2056 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"57⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE58⤵
- Executes dropped EXE
PID:2256 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"59⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3032 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"61⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE62⤵
- Executes dropped EXE
PID:2324 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"63⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE64⤵
- Executes dropped EXE
PID:1672 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"65⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE66⤵PID:3028
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"67⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE68⤵PID:948
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"69⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE70⤵PID:2392
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"71⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE72⤵PID:884
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"73⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE74⤵PID:1716
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"75⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE76⤵
- Drops file in Windows directory
PID:2824 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"77⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE78⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2904 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"79⤵
- Drops file in Windows directory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE80⤵PID:3020
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"81⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE82⤵PID:2944
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"83⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE84⤵
- Drops file in Windows directory
PID:2636 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"85⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE86⤵PID:2760
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"87⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE88⤵PID:2704
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"89⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE90⤵PID:2504
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"91⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE92⤵PID:2996
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"93⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE94⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1064 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"95⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE96⤵PID:912
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"97⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE98⤵
- System Location Discovery: System Language Discovery
PID:640 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"99⤵
- System Location Discovery: System Language Discovery
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE100⤵PID:1336
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"101⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE102⤵PID:1496
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"103⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE104⤵
- Drops file in Windows directory
PID:1668 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"105⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE106⤵
- System Location Discovery: System Language Discovery
PID:1156 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"107⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE108⤵PID:2592
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"109⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE110⤵
- Drops file in Windows directory
PID:1448 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"111⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE112⤵
- System Location Discovery: System Language Discovery
PID:2112 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"113⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE114⤵PID:1924
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"115⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE116⤵PID:1780
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"117⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE118⤵PID:2208
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"119⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE120⤵PID:648
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5F73C5~1.EXE"121⤵PID:1488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-