Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-11-2024 12:43
Behavioral task
behavioral1
Sample
ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
120 seconds
Behavioral task
behavioral2
Sample
ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
120 seconds
General
-
Target
ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe
-
Size
249KB
-
MD5
5b947c4d6e59b8ccbedee940c6862110
-
SHA1
2279a75a9625f0fd5ca779c1b62dba6aeda3a8f2
-
SHA256
ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451
-
SHA512
791a2dff640721f24ebaeeab0477118f8c0b584b7233d69f6eef2db528358243144e81625090c2c47d7d44a11818d2a91a0e1e6c65dc4fe4af61d8b805422830
-
SSDEEP
3072:sr85C5+l9BdmLlX1V8EzWY1SQpavo4zc5r85C:k95+7mkPY1/GzM9
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
Processes:
resource yara_rule behavioral1/files/0x0008000000014b28-2.dat family_neshta behavioral1/files/0x0009000000014b54-16.dat family_neshta behavioral1/files/0x0001000000010314-20.dat family_neshta behavioral1/files/0x0001000000010312-19.dat family_neshta behavioral1/files/0x0013000000010321-18.dat family_neshta behavioral1/files/0x005e000000010323-17.dat family_neshta behavioral1/memory/2576-29-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2604-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2784-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2512-43-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2476-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2924-57-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2944-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/568-71-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2664-85-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/580-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2804-101-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2500-100-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d2-111.dat family_neshta behavioral1/memory/2364-115-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2284-116-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d7-119.dat family_neshta behavioral1/files/0x000100000000f7c9-134.dat family_neshta behavioral1/files/0x000100000000f7e5-138.dat family_neshta behavioral1/memory/1452-141-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2224-143-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1460-162-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1696-161-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2196-180-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2320-179-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1572-189-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1728-190-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1708-204-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2128-205-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1584-218-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2864-219-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1724-233-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2540-232-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/340-246-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2708-245-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/616-269-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1520-268-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2716-288-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2776-289-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2572-297-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2712-296-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1052-305-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2536-304-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/536-320-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2732-319-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/988-330-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1412-329-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1332-337-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/580-338-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2936-346-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2520-345-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1924-353-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1928-354-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2368-362-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1628-361-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1900-370-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1996-369-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1864-377-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2636-378-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
Processes:
ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exesvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.compid Process 2568 ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe 2604 svchost.com 2576 BA12FA~1.EXE 2784 svchost.com 2512 BA12FA~1.EXE 2476 svchost.com 2924 BA12FA~1.EXE 2944 svchost.com 568 BA12FA~1.EXE 580 svchost.com 2664 BA12FA~1.EXE 2804 svchost.com 2500 BA12FA~1.EXE 2284 svchost.com 2364 BA12FA~1.EXE 2224 svchost.com 1452 BA12FA~1.EXE 1460 svchost.com 1696 BA12FA~1.EXE 2320 svchost.com 2196 BA12FA~1.EXE 1728 svchost.com 1572 BA12FA~1.EXE 2128 svchost.com 1708 BA12FA~1.EXE 1584 svchost.com 2864 BA12FA~1.EXE 1724 svchost.com 2540 BA12FA~1.EXE 340 svchost.com 2708 BA12FA~1.EXE 616 svchost.com 1520 BA12FA~1.EXE 2776 svchost.com 2716 BA12FA~1.EXE 2572 svchost.com 2712 BA12FA~1.EXE 1052 svchost.com 2536 BA12FA~1.EXE 2732 svchost.com 536 BA12FA~1.EXE 988 svchost.com 1412 BA12FA~1.EXE 1332 svchost.com 580 BA12FA~1.EXE 2936 svchost.com 2520 BA12FA~1.EXE 1924 svchost.com 1928 BA12FA~1.EXE 2368 svchost.com 1628 BA12FA~1.EXE 1996 svchost.com 1900 BA12FA~1.EXE 2636 svchost.com 1864 BA12FA~1.EXE 1876 svchost.com 2064 BA12FA~1.EXE 2324 svchost.com 2252 BA12FA~1.EXE 2112 svchost.com 1288 BA12FA~1.EXE 2424 svchost.com 1620 BA12FA~1.EXE 3064 svchost.com -
Loads dropped DLL 64 IoCs
Processes:
ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.compid Process 2792 ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe 2792 ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe 2604 svchost.com 2604 svchost.com 2784 svchost.com 2784 svchost.com 2476 svchost.com 2476 svchost.com 2944 svchost.com 2944 svchost.com 580 svchost.com 580 svchost.com 2804 svchost.com 2804 svchost.com 2284 svchost.com 2284 svchost.com 2224 svchost.com 2224 svchost.com 1460 svchost.com 1460 svchost.com 2568 ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe 2792 ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe 2320 svchost.com 2320 svchost.com 1728 svchost.com 1728 svchost.com 2128 svchost.com 2128 svchost.com 1584 svchost.com 1584 svchost.com 1724 svchost.com 1724 svchost.com 340 svchost.com 340 svchost.com 616 svchost.com 616 svchost.com 2776 svchost.com 2776 svchost.com 2572 svchost.com 2572 svchost.com 1052 svchost.com 1052 svchost.com 2732 svchost.com 2732 svchost.com 988 svchost.com 988 svchost.com 1332 svchost.com 1332 svchost.com 2936 svchost.com 2936 svchost.com 1924 svchost.com 1924 svchost.com 2368 svchost.com 2368 svchost.com 1996 svchost.com 1996 svchost.com 2636 svchost.com 2636 svchost.com 1876 svchost.com 1876 svchost.com 2324 svchost.com 2324 svchost.com 2112 svchost.com 2112 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exeba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exedescription ioc Process File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe -
Drops file in Windows directory 64 IoCs
Processes:
svchost.comBA12FA~1.EXEBA12FA~1.EXEBA12FA~1.EXEBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comsvchost.comBA12FA~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comBA12FA~1.EXEBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comsvchost.comsvchost.comBA12FA~1.EXEBA12FA~1.EXEsvchost.comBA12FA~1.EXEBA12FA~1.EXEsvchost.comsvchost.comBA12FA~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comBA12FA~1.EXEBA12FA~1.EXEBA12FA~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exeBA12FA~1.EXEBA12FA~1.EXEBA12FA~1.EXEBA12FA~1.EXEsvchost.comBA12FA~1.EXEBA12FA~1.EXEBA12FA~1.EXEBA12FA~1.EXEBA12FA~1.EXEBA12FA~1.EXEBA12FA~1.EXEBA12FA~1.EXEsvchost.comsvchost.comBA12FA~1.EXEBA12FA~1.EXEBA12FA~1.EXEsvchost.comdescription ioc Process File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com BA12FA~1.EXE File opened for modification C:\Windows\directx.sys BA12FA~1.EXE File opened for modification C:\Windows\svchost.com BA12FA~1.EXE File opened for modification C:\Windows\directx.sys BA12FA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com BA12FA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys BA12FA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys BA12FA~1.EXE File opened for modification C:\Windows\directx.sys BA12FA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys BA12FA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys BA12FA~1.EXE File opened for modification C:\Windows\directx.sys BA12FA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com BA12FA~1.EXE File opened for modification C:\Windows\directx.sys BA12FA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys BA12FA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com BA12FA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys BA12FA~1.EXE File opened for modification C:\Windows\svchost.com BA12FA~1.EXE File opened for modification C:\Windows\directx.sys BA12FA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe File opened for modification C:\Windows\directx.sys BA12FA~1.EXE File opened for modification C:\Windows\directx.sys BA12FA~1.EXE File opened for modification C:\Windows\directx.sys BA12FA~1.EXE File opened for modification C:\Windows\svchost.com BA12FA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com BA12FA~1.EXE File opened for modification C:\Windows\directx.sys BA12FA~1.EXE File opened for modification C:\Windows\directx.sys BA12FA~1.EXE File opened for modification C:\Windows\svchost.com BA12FA~1.EXE File opened for modification C:\Windows\svchost.com BA12FA~1.EXE File opened for modification C:\Windows\svchost.com BA12FA~1.EXE File opened for modification C:\Windows\svchost.com BA12FA~1.EXE File opened for modification C:\Windows\directx.sys BA12FA~1.EXE File opened for modification C:\Windows\directx.sys BA12FA~1.EXE File opened for modification C:\Windows\svchost.com BA12FA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys BA12FA~1.EXE File opened for modification C:\Windows\svchost.com BA12FA~1.EXE File opened for modification C:\Windows\directx.sys BA12FA~1.EXE File opened for modification C:\Windows\svchost.com BA12FA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
svchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEBA12FA~1.EXEBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comsvchost.comBA12FA~1.EXEBA12FA~1.EXEBA12FA~1.EXEsvchost.comsvchost.comBA12FA~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comBA12FA~1.EXEBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEBA12FA~1.EXEsvchost.comsvchost.comsvchost.comBA12FA~1.EXEBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comsvchost.comBA12FA~1.EXEsvchost.comsvchost.comdescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA12FA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA12FA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA12FA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA12FA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA12FA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA12FA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA12FA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA12FA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA12FA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA12FA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA12FA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA12FA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA12FA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA12FA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA12FA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA12FA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA12FA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA12FA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA12FA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA12FA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA12FA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA12FA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA12FA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA12FA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA12FA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
Processes:
ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
BA12FA~1.EXEpid Process 1484 BA12FA~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exeba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exesvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEsvchost.comBA12FA~1.EXEdescription pid Process procid_target PID 2792 wrote to memory of 2568 2792 ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe 28 PID 2792 wrote to memory of 2568 2792 ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe 28 PID 2792 wrote to memory of 2568 2792 ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe 28 PID 2792 wrote to memory of 2568 2792 ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe 28 PID 2568 wrote to memory of 2604 2568 ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe 29 PID 2568 wrote to memory of 2604 2568 ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe 29 PID 2568 wrote to memory of 2604 2568 ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe 29 PID 2568 wrote to memory of 2604 2568 ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe 29 PID 2604 wrote to memory of 2576 2604 svchost.com 30 PID 2604 wrote to memory of 2576 2604 svchost.com 30 PID 2604 wrote to memory of 2576 2604 svchost.com 30 PID 2604 wrote to memory of 2576 2604 svchost.com 30 PID 2576 wrote to memory of 2784 2576 BA12FA~1.EXE 31 PID 2576 wrote to memory of 2784 2576 BA12FA~1.EXE 31 PID 2576 wrote to memory of 2784 2576 BA12FA~1.EXE 31 PID 2576 wrote to memory of 2784 2576 BA12FA~1.EXE 31 PID 2784 wrote to memory of 2512 2784 svchost.com 32 PID 2784 wrote to memory of 2512 2784 svchost.com 32 PID 2784 wrote to memory of 2512 2784 svchost.com 32 PID 2784 wrote to memory of 2512 2784 svchost.com 32 PID 2512 wrote to memory of 2476 2512 BA12FA~1.EXE 33 PID 2512 wrote to memory of 2476 2512 BA12FA~1.EXE 33 PID 2512 wrote to memory of 2476 2512 BA12FA~1.EXE 33 PID 2512 wrote to memory of 2476 2512 BA12FA~1.EXE 33 PID 2476 wrote to memory of 2924 2476 svchost.com 34 PID 2476 wrote to memory of 2924 2476 svchost.com 34 PID 2476 wrote to memory of 2924 2476 svchost.com 34 PID 2476 wrote to memory of 2924 2476 svchost.com 34 PID 2924 wrote to memory of 2944 2924 BA12FA~1.EXE 35 PID 2924 wrote to memory of 2944 2924 BA12FA~1.EXE 35 PID 2924 wrote to memory of 2944 2924 BA12FA~1.EXE 35 PID 2924 wrote to memory of 2944 2924 BA12FA~1.EXE 35 PID 2944 wrote to memory of 568 2944 svchost.com 36 PID 2944 wrote to memory of 568 2944 svchost.com 36 PID 2944 wrote to memory of 568 2944 svchost.com 36 PID 2944 wrote to memory of 568 2944 svchost.com 36 PID 568 wrote to memory of 580 568 BA12FA~1.EXE 72 PID 568 wrote to memory of 580 568 BA12FA~1.EXE 72 PID 568 wrote to memory of 580 568 BA12FA~1.EXE 72 PID 568 wrote to memory of 580 568 BA12FA~1.EXE 72 PID 580 wrote to memory of 2664 580 svchost.com 38 PID 580 wrote to memory of 2664 580 svchost.com 38 PID 580 wrote to memory of 2664 580 svchost.com 38 PID 580 wrote to memory of 2664 580 svchost.com 38 PID 2664 wrote to memory of 2804 2664 BA12FA~1.EXE 39 PID 2664 wrote to memory of 2804 2664 BA12FA~1.EXE 39 PID 2664 wrote to memory of 2804 2664 BA12FA~1.EXE 39 PID 2664 wrote to memory of 2804 2664 BA12FA~1.EXE 39 PID 2804 wrote to memory of 2500 2804 svchost.com 40 PID 2804 wrote to memory of 2500 2804 svchost.com 40 PID 2804 wrote to memory of 2500 2804 svchost.com 40 PID 2804 wrote to memory of 2500 2804 svchost.com 40 PID 2500 wrote to memory of 2284 2500 BA12FA~1.EXE 127 PID 2500 wrote to memory of 2284 2500 BA12FA~1.EXE 127 PID 2500 wrote to memory of 2284 2500 BA12FA~1.EXE 127 PID 2500 wrote to memory of 2284 2500 BA12FA~1.EXE 127 PID 2284 wrote to memory of 2364 2284 svchost.com 42 PID 2284 wrote to memory of 2364 2284 svchost.com 42 PID 2284 wrote to memory of 2364 2284 svchost.com 42 PID 2284 wrote to memory of 2364 2284 svchost.com 42 PID 2364 wrote to memory of 2224 2364 BA12FA~1.EXE 43 PID 2364 wrote to memory of 2224 2364 BA12FA~1.EXE 43 PID 2364 wrote to memory of 2224 2364 BA12FA~1.EXE 43 PID 2364 wrote to memory of 2224 2364 BA12FA~1.EXE 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe"C:\Users\Admin\AppData\Local\Temp\ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\3582-490\ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\ba12faf36dc84a0bbd0d18dd3cb6f8813794c782a8a023663188cf0cf7cf8451N.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE18⤵
- Executes dropped EXE
PID:1452 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE20⤵
- Executes dropped EXE
PID:1696 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE22⤵
- Executes dropped EXE
PID:2196 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE24⤵
- Executes dropped EXE
PID:1572 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE26⤵
- Executes dropped EXE
PID:1708 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE28⤵
- Executes dropped EXE
PID:2864 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE30⤵
- Executes dropped EXE
PID:2540 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:340 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE32⤵
- Executes dropped EXE
PID:2708 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:616 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE34⤵
- Executes dropped EXE
PID:1520 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE36⤵
- Executes dropped EXE
PID:2716 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2712 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE40⤵
- Executes dropped EXE
PID:2536 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE42⤵
- Executes dropped EXE
PID:536 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:988 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1412 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE46⤵
- Executes dropped EXE
PID:580 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE48⤵
- Executes dropped EXE
PID:2520 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE50⤵
- Executes dropped EXE
PID:1928 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE52⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1628 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE54⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1900 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE56⤵
- Executes dropped EXE
PID:1864 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE58⤵
- Executes dropped EXE
PID:2064 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE60⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2252 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE62⤵
- Executes dropped EXE
PID:1288 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"63⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE64⤵
- Executes dropped EXE
PID:1620 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"65⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE66⤵PID:1796
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"67⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE68⤵
- Drops file in Windows directory
PID:2128 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"69⤵
- Drops file in Windows directory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE70⤵
- System Location Discovery: System Language Discovery
PID:600 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"71⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE72⤵PID:2356
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"73⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE74⤵
- Drops file in Windows directory
PID:2404 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"75⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE76⤵
- System Location Discovery: System Language Discovery
PID:2204 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"77⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE78⤵PID:2408
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"79⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE80⤵PID:2080
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"81⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE82⤵
- Drops file in Windows directory
PID:2660 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"83⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE84⤵PID:2748
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"85⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE86⤵PID:2456
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"87⤵
- System Location Discovery: System Language Discovery
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE88⤵
- System Location Discovery: System Language Discovery
PID:2512 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"89⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE90⤵PID:1576
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"91⤵
- Drops file in Windows directory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE92⤵PID:2700
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"93⤵
- System Location Discovery: System Language Discovery
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE94⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2704 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"95⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE96⤵PID:2208
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"97⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE98⤵PID:356
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"99⤵
- Drops file in Windows directory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE100⤵PID:2212
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"101⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE102⤵PID:1616
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"103⤵
- Drops file in Windows directory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE104⤵PID:1884
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"105⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE106⤵
- System Location Discovery: System Language Discovery
PID:1856 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"107⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE108⤵PID:2308
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"109⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE110⤵PID:2252
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"111⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE112⤵PID:2336
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"113⤵
- System Location Discovery: System Language Discovery
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE114⤵PID:2236
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"115⤵
- System Location Discovery: System Language Discovery
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE116⤵PID:1364
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"117⤵
- System Location Discovery: System Language Discovery
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE118⤵PID:3056
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"119⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE120⤵PID:1704
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\BA12FA~1.EXE"121⤵PID:2176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-