Analysis
-
max time kernel
32s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/11/2024, 06:41
Behavioral task
behavioral1
Sample
fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe
-
Size
489KB
-
MD5
36699c5e72c615e52a3ccec1d1e34902
-
SHA1
68cfb52b76dcad96c8235b77966699b439fbcd8f
-
SHA256
fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76
-
SHA512
9c7caac8d57bf4eec23e579962bf909a1bd4e1684ff0554273fa0d085584207c70b19db9e07995eac98c105d03d536b2c975166127d2ecdb5ae293c4510f1071
-
SSDEEP
3072:sr85Cp59nwCVssMlaySQp5xqIFvxkuFzCtD5huH5jPWxWiwpup3jSSu5rPOdxWr9:k9NV9y/p58+vxoGH5jaQ5eW9
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0008000000016c58-2.dat family_neshta behavioral1/files/0x0008000000016ca2-15.dat family_neshta behavioral1/files/0x0007000000010348-18.dat family_neshta behavioral1/files/0x0033000000010618-17.dat family_neshta behavioral1/files/0x0001000000010314-20.dat family_neshta behavioral1/files/0x0001000000010312-19.dat family_neshta behavioral1/memory/2924-31-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2756-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2892-43-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2616-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1704-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2780-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1732-71-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2608-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3016-85-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2872-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2856-101-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d3-102.dat family_neshta behavioral1/memory/2876-100-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7e6-121.dat family_neshta behavioral1/files/0x000100000000f703-125.dat family_neshta behavioral1/memory/2828-133-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1932-132-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x0001000000010370-151.dat family_neshta behavioral1/memory/1000-155-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2140-156-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1492-180-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/724-179-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1672-198-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2648-199-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/716-215-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1692-214-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2468-240-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/556-241-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2164-259-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1764-258-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2264-266-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2120-267-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/340-281-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2240-280-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2756-291-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2804-290-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2748-299-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2892-298-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2984-307-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2372-306-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2832-315-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2652-314-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2460-323-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1852-322-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1248-330-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3024-331-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2292-339-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3012-338-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2944-347-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2964-346-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1960-355-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2704-354-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2552-362-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1104-363-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/592-370-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2972-371-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1180-379-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1660-378-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2408 fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe 2924 svchost.com 2756 FBE01D~1.EXE 2892 svchost.com 2616 FBE01D~1.EXE 1704 svchost.com 2780 FBE01D~1.EXE 2608 svchost.com 1732 FBE01D~1.EXE 2872 svchost.com 3016 FBE01D~1.EXE 2856 svchost.com 2876 FBE01D~1.EXE 2828 svchost.com 1932 FBE01D~1.EXE 2140 svchost.com 1000 FBE01D~1.EXE 1492 svchost.com 724 FBE01D~1.EXE 1672 svchost.com 2648 FBE01D~1.EXE 716 svchost.com 1692 FBE01D~1.EXE 556 svchost.com 2468 FBE01D~1.EXE 2164 svchost.com 1764 FBE01D~1.EXE 2264 svchost.com 2120 FBE01D~1.EXE 340 svchost.com 2240 FBE01D~1.EXE 2804 svchost.com 2756 FBE01D~1.EXE 2748 svchost.com 2892 FBE01D~1.EXE 2984 svchost.com 2372 FBE01D~1.EXE 2832 svchost.com 2652 FBE01D~1.EXE 2460 svchost.com 1852 FBE01D~1.EXE 3024 svchost.com 1248 FBE01D~1.EXE 2292 svchost.com 3012 FBE01D~1.EXE 2944 svchost.com 2964 FBE01D~1.EXE 1960 svchost.com 2704 FBE01D~1.EXE 1104 svchost.com 2552 FBE01D~1.EXE 2972 svchost.com 592 FBE01D~1.EXE 1180 svchost.com 1660 FBE01D~1.EXE 2060 svchost.com 632 FBE01D~1.EXE 2020 svchost.com 2268 FBE01D~1.EXE 724 svchost.com 1656 FBE01D~1.EXE 348 svchost.com 1540 FBE01D~1.EXE 1748 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 1740 fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe 1740 fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe 2924 svchost.com 2924 svchost.com 2892 svchost.com 2892 svchost.com 1704 svchost.com 1704 svchost.com 2608 svchost.com 2608 svchost.com 2872 svchost.com 2872 svchost.com 2856 svchost.com 2856 svchost.com 2828 svchost.com 2828 svchost.com 2408 fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe 1740 fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe 1740 fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe 2140 svchost.com 2140 svchost.com 1492 svchost.com 1492 svchost.com 1740 fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe 1740 fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe 2408 fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe 1672 svchost.com 1672 svchost.com 716 svchost.com 716 svchost.com 556 svchost.com 556 svchost.com 2164 svchost.com 2164 svchost.com 1740 fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe 1740 fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe 2264 svchost.com 2264 svchost.com 340 svchost.com 340 svchost.com 2804 svchost.com 2804 svchost.com 2748 svchost.com 2748 svchost.com 2984 svchost.com 2984 svchost.com 2832 svchost.com 2832 svchost.com 2460 svchost.com 2460 svchost.com 3024 svchost.com 3024 svchost.com 2292 svchost.com 2292 svchost.com 2944 svchost.com 2944 svchost.com 1960 svchost.com 1960 svchost.com 1104 svchost.com 1104 svchost.com 2972 svchost.com 2972 svchost.com 1180 svchost.com 1180 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com FBE01D~1.EXE File opened for modification C:\Windows\directx.sys FBE01D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys FBE01D~1.EXE File opened for modification C:\Windows\svchost.com FBE01D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com FBE01D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys FBE01D~1.EXE File opened for modification C:\Windows\svchost.com FBE01D~1.EXE File opened for modification C:\Windows\svchost.com FBE01D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys FBE01D~1.EXE File opened for modification C:\Windows\svchost.com FBE01D~1.EXE File opened for modification C:\Windows\svchost.com FBE01D~1.EXE File opened for modification C:\Windows\svchost.com FBE01D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys FBE01D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys FBE01D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com FBE01D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com FBE01D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys FBE01D~1.EXE File opened for modification C:\Windows\directx.sys FBE01D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys FBE01D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys FBE01D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com FBE01D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys FBE01D~1.EXE File opened for modification C:\Windows\directx.sys FBE01D~1.EXE File opened for modification C:\Windows\directx.sys FBE01D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys FBE01D~1.EXE File opened for modification C:\Windows\directx.sys FBE01D~1.EXE File opened for modification C:\Windows\directx.sys FBE01D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys FBE01D~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com FBE01D~1.EXE File opened for modification C:\Windows\svchost.com FBE01D~1.EXE File opened for modification C:\Windows\directx.sys FBE01D~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE01D~1.EXE -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2408 1740 fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe 30 PID 1740 wrote to memory of 2408 1740 fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe 30 PID 1740 wrote to memory of 2408 1740 fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe 30 PID 1740 wrote to memory of 2408 1740 fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe 30 PID 2408 wrote to memory of 2924 2408 fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe 31 PID 2408 wrote to memory of 2924 2408 fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe 31 PID 2408 wrote to memory of 2924 2408 fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe 31 PID 2408 wrote to memory of 2924 2408 fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe 31 PID 2924 wrote to memory of 2756 2924 svchost.com 62 PID 2924 wrote to memory of 2756 2924 svchost.com 62 PID 2924 wrote to memory of 2756 2924 svchost.com 62 PID 2924 wrote to memory of 2756 2924 svchost.com 62 PID 2756 wrote to memory of 2892 2756 FBE01D~1.EXE 64 PID 2756 wrote to memory of 2892 2756 FBE01D~1.EXE 64 PID 2756 wrote to memory of 2892 2756 FBE01D~1.EXE 64 PID 2756 wrote to memory of 2892 2756 FBE01D~1.EXE 64 PID 2892 wrote to memory of 2616 2892 svchost.com 34 PID 2892 wrote to memory of 2616 2892 svchost.com 34 PID 2892 wrote to memory of 2616 2892 svchost.com 34 PID 2892 wrote to memory of 2616 2892 svchost.com 34 PID 2616 wrote to memory of 1704 2616 FBE01D~1.EXE 35 PID 2616 wrote to memory of 1704 2616 FBE01D~1.EXE 35 PID 2616 wrote to memory of 1704 2616 FBE01D~1.EXE 35 PID 2616 wrote to memory of 1704 2616 FBE01D~1.EXE 35 PID 1704 wrote to memory of 2780 1704 svchost.com 36 PID 1704 wrote to memory of 2780 1704 svchost.com 36 PID 1704 wrote to memory of 2780 1704 svchost.com 36 PID 1704 wrote to memory of 2780 1704 svchost.com 36 PID 2780 wrote to memory of 2608 2780 FBE01D~1.EXE 37 PID 2780 wrote to memory of 2608 2780 FBE01D~1.EXE 37 PID 2780 wrote to memory of 2608 2780 FBE01D~1.EXE 37 PID 2780 wrote to memory of 2608 2780 FBE01D~1.EXE 37 PID 2608 wrote to memory of 1732 2608 svchost.com 38 PID 2608 wrote to memory of 1732 2608 svchost.com 38 PID 2608 wrote to memory of 1732 2608 svchost.com 38 PID 2608 wrote to memory of 1732 2608 svchost.com 38 PID 1732 wrote to memory of 2872 1732 FBE01D~1.EXE 39 PID 1732 wrote to memory of 2872 1732 FBE01D~1.EXE 39 PID 1732 wrote to memory of 2872 1732 FBE01D~1.EXE 39 PID 1732 wrote to memory of 2872 1732 FBE01D~1.EXE 39 PID 2872 wrote to memory of 3016 2872 svchost.com 40 PID 2872 wrote to memory of 3016 2872 svchost.com 40 PID 2872 wrote to memory of 3016 2872 svchost.com 40 PID 2872 wrote to memory of 3016 2872 svchost.com 40 PID 3016 wrote to memory of 2856 3016 FBE01D~1.EXE 41 PID 3016 wrote to memory of 2856 3016 FBE01D~1.EXE 41 PID 3016 wrote to memory of 2856 3016 FBE01D~1.EXE 41 PID 3016 wrote to memory of 2856 3016 FBE01D~1.EXE 41 PID 2856 wrote to memory of 2876 2856 svchost.com 42 PID 2856 wrote to memory of 2876 2856 svchost.com 42 PID 2856 wrote to memory of 2876 2856 svchost.com 42 PID 2856 wrote to memory of 2876 2856 svchost.com 42 PID 2876 wrote to memory of 2828 2876 FBE01D~1.EXE 43 PID 2876 wrote to memory of 2828 2876 FBE01D~1.EXE 43 PID 2876 wrote to memory of 2828 2876 FBE01D~1.EXE 43 PID 2876 wrote to memory of 2828 2876 FBE01D~1.EXE 43 PID 2828 wrote to memory of 1932 2828 svchost.com 44 PID 2828 wrote to memory of 1932 2828 svchost.com 44 PID 2828 wrote to memory of 1932 2828 svchost.com 44 PID 2828 wrote to memory of 1932 2828 svchost.com 44 PID 1932 wrote to memory of 2140 1932 FBE01D~1.EXE 45 PID 1932 wrote to memory of 2140 1932 FBE01D~1.EXE 45 PID 1932 wrote to memory of 2140 1932 FBE01D~1.EXE 45 PID 1932 wrote to memory of 2140 1932 FBE01D~1.EXE 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe"C:\Users\Admin\AppData\Local\Temp\fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\3582-490\fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\fbe01d8c4ecd4f2d12ef72a18dfb45a7d09ea47561ca943afbbf5adc07085d76.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE14⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE18⤵
- Executes dropped EXE
PID:1000 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE20⤵
- Executes dropped EXE
PID:724 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE22⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2648 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:716 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE24⤵
- Executes dropped EXE
PID:1692 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE26⤵
- Executes dropped EXE
PID:2468 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE28⤵
- Executes dropped EXE
PID:1764 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2120 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:340 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE32⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2240 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE34⤵
- Executes dropped EXE
PID:2756 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE36⤵
- Executes dropped EXE
PID:2892 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE38⤵
- Executes dropped EXE
PID:2372 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE40⤵
- Executes dropped EXE
PID:2652 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE42⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1852 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE44⤵
- Executes dropped EXE
PID:1248 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE46⤵
- Executes dropped EXE
PID:3012 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE48⤵
- Executes dropped EXE
PID:2964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE50⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2704 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE52⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2552 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE54⤵
- Executes dropped EXE
PID:592 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE56⤵
- Executes dropped EXE
PID:1660 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"57⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE58⤵
- Executes dropped EXE
PID:632 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"59⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE60⤵
- Executes dropped EXE
PID:2268 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:724 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE62⤵
- Executes dropped EXE
PID:1656 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"63⤵
- Executes dropped EXE
PID:348 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1540 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"65⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE66⤵PID:1700
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"67⤵
- Drops file in Windows directory
PID:716 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE68⤵PID:1544
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"69⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE70⤵PID:484
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"71⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE72⤵
- Drops file in Windows directory
PID:2248 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"73⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE74⤵PID:2172
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"75⤵
- System Location Discovery: System Language Discovery
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE76⤵PID:2264
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"77⤵
- System Location Discovery: System Language Discovery
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE78⤵
- System Location Discovery: System Language Discovery
PID:2472 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"79⤵
- Drops file in Windows directory
PID:340 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE80⤵PID:2796
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"81⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE82⤵PID:2732
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"83⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE84⤵PID:2848
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"85⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE86⤵PID:2664
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"87⤵
- System Location Discovery: System Language Discovery
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE88⤵PID:2340
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"89⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE90⤵
- System Location Discovery: System Language Discovery
PID:3008 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"91⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE92⤵
- Drops file in Windows directory
PID:2596 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"93⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE94⤵PID:2956
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"95⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE96⤵PID:1928
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"97⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE98⤵
- System Location Discovery: System Language Discovery
PID:2152 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"99⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE100⤵PID:1372
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"101⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE102⤵PID:380
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"103⤵
- Drops file in Windows directory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE104⤵PID:2144
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"105⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE106⤵PID:2072
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"107⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE108⤵PID:1760
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"109⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE110⤵PID:1188
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"111⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE112⤵PID:1948
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"113⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE114⤵
- System Location Discovery: System Language Discovery
PID:2324 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"115⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE116⤵
- System Location Discovery: System Language Discovery
PID:1788 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"117⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE118⤵PID:2468
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"119⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE120⤵PID:2180
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\FBE01D~1.EXE"121⤵
- System Location Discovery: System Language Discovery
PID:552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-