Analysis
-
max time kernel
32s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
06-11-2024 05:20
Behavioral task
behavioral1
Sample
a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe
Resource
win7-20241023-en
windows7-x64
14 signatures
120 seconds
Behavioral task
behavioral2
Sample
a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
120 seconds
General
-
Target
a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe
-
Size
145KB
-
MD5
ed8744089a21fbf0c57cd808b8cfae40
-
SHA1
9ef953f272b1541e68f728a167edd164e660ebfc
-
SHA256
a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdf
-
SHA512
b4aaa5c0b82a18eda782f73ee4fedc59190fd89bb0cb1223a85fcd63751e28eede40bafdfdf65f9e0df7c7ef8df3929f3a465eb0b08f99baa96074f2804cd120
-
SSDEEP
1536:JxqjQ+P04wsmJCjzmn+B79k1L3lxy7MrQ1lOxqjQ+P04wsmJC:sr85CjzncYXr85C
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
Processes:
resource yara_rule behavioral1/files/0x0009000000015cc8-2.dat family_neshta behavioral1/files/0x0008000000015cd1-21.dat family_neshta behavioral1/files/0x0001000000010319-20.dat family_neshta behavioral1/files/0x0001000000010317-19.dat family_neshta behavioral1/files/0x0013000000010681-18.dat family_neshta behavioral1/files/0x00100000000106a5-17.dat family_neshta behavioral1/memory/2804-31-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2956-32-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2940-47-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2788-46-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2472-62-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/352-61-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1108-77-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2884-76-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2220-91-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3068-92-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2340-108-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/848-106-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1856-121-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1936-122-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1888-136-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/304-135-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2456-152-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3040-153-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2508-166-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2300-167-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1140-181-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1064-180-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1708-198-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1400-199-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/604-213-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2640-215-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2548-226-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2008-225-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3052-235-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2396-234-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1668-249-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1712-250-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2796-260-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1608-261-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2952-284-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2156-283-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1192-299-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2700-300-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/352-309-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/696-310-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1480-317-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1952-318-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2884-325-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2544-326-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2200-335-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/296-334-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2052-349-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2568-350-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/664-362-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2012-361-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/400-370-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1936-369-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/656-377-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3028-378-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2524-386-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2520-385-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2440-393-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1052-394-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
Processes:
a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exesvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.compid Process 2960 a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe 2956 svchost.com 2804 A96EF2~1.EXE 2940 svchost.com 2788 A96EF2~1.EXE 2472 svchost.com 352 A96EF2~1.EXE 1108 svchost.com 2884 A96EF2~1.EXE 3068 svchost.com 2220 A96EF2~1.EXE 2340 svchost.com 848 A96EF2~1.EXE 1936 svchost.com 1856 A96EF2~1.EXE 1888 svchost.com 304 A96EF2~1.EXE 3040 svchost.com 2456 A96EF2~1.EXE 2300 svchost.com 2508 A96EF2~1.EXE 1140 svchost.com 1064 A96EF2~1.EXE 1400 svchost.com 1708 A96EF2~1.EXE 2640 svchost.com 604 A96EF2~1.EXE 2008 svchost.com 2548 A96EF2~1.EXE 3052 svchost.com 2396 A96EF2~1.EXE 1712 svchost.com 1668 A96EF2~1.EXE 1608 svchost.com 2796 A96EF2~1.EXE 2952 svchost.com 2156 A96EF2~1.EXE 2700 svchost.com 1192 A96EF2~1.EXE 696 svchost.com 352 A96EF2~1.EXE 1952 svchost.com 1480 A96EF2~1.EXE 2544 svchost.com 2884 A96EF2~1.EXE 2200 svchost.com 296 A96EF2~1.EXE 2052 svchost.com 2568 A96EF2~1.EXE 2012 svchost.com 664 A96EF2~1.EXE 1936 svchost.com 400 A96EF2~1.EXE 3028 svchost.com 656 A96EF2~1.EXE 2520 svchost.com 2524 A96EF2~1.EXE 1052 svchost.com 2440 A96EF2~1.EXE 1912 svchost.com 1028 A96EF2~1.EXE 2612 svchost.com 1068 A96EF2~1.EXE 2196 svchost.com -
Loads dropped DLL 64 IoCs
Processes:
a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exea96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exesvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.compid Process 3012 a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe 3012 a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe 2960 a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe 2956 svchost.com 2956 svchost.com 2804 A96EF2~1.EXE 2940 svchost.com 2940 svchost.com 2788 A96EF2~1.EXE 2472 svchost.com 2472 svchost.com 352 A96EF2~1.EXE 1108 svchost.com 1108 svchost.com 2884 A96EF2~1.EXE 3068 svchost.com 3068 svchost.com 2220 A96EF2~1.EXE 2340 svchost.com 2340 svchost.com 848 A96EF2~1.EXE 1936 svchost.com 1936 svchost.com 1856 A96EF2~1.EXE 1888 svchost.com 1888 svchost.com 304 A96EF2~1.EXE 3040 svchost.com 3040 svchost.com 2960 a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe 3012 a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe 2456 A96EF2~1.EXE 2300 svchost.com 2300 svchost.com 2508 A96EF2~1.EXE 1140 svchost.com 1140 svchost.com 1064 A96EF2~1.EXE 1400 svchost.com 1400 svchost.com 1708 A96EF2~1.EXE 2960 a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe 2640 svchost.com 2640 svchost.com 604 A96EF2~1.EXE 2008 svchost.com 2008 svchost.com 2548 A96EF2~1.EXE 3052 svchost.com 3052 svchost.com 2396 A96EF2~1.EXE 1712 svchost.com 1712 svchost.com 3012 a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe 1668 A96EF2~1.EXE 1608 svchost.com 1608 svchost.com 2796 A96EF2~1.EXE 2952 svchost.com 2960 a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe 2952 svchost.com 2156 A96EF2~1.EXE 2700 svchost.com 2700 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exea96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exedescription ioc Process File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe -
Drops file in Windows directory 64 IoCs
Processes:
A96EF2~1.EXEA96EF2~1.EXEA96EF2~1.EXEsvchost.comA96EF2~1.EXEA96EF2~1.EXEsvchost.comA96EF2~1.EXEA96EF2~1.EXEA96EF2~1.EXEA96EF2~1.EXEA96EF2~1.EXEsvchost.comA96EF2~1.EXEA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEA96EF2~1.EXEA96EF2~1.EXEsvchost.comsvchost.comA96EF2~1.EXEA96EF2~1.EXEA96EF2~1.EXEsvchost.comA96EF2~1.EXEA96EF2~1.EXEsvchost.comsvchost.comA96EF2~1.EXEsvchost.comsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEA96EF2~1.EXEsvchost.comsvchost.comA96EF2~1.EXEA96EF2~1.EXEA96EF2~1.EXEsvchost.comsvchost.comsvchost.comA96EF2~1.EXEA96EF2~1.EXEsvchost.comsvchost.comA96EF2~1.EXEA96EF2~1.EXEsvchost.comA96EF2~1.EXEA96EF2~1.EXEsvchost.comsvchost.comA96EF2~1.EXEA96EF2~1.EXEsvchost.comdescription ioc Process File opened for modification C:\Windows\directx.sys A96EF2~1.EXE File opened for modification C:\Windows\directx.sys A96EF2~1.EXE File opened for modification C:\Windows\directx.sys A96EF2~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com A96EF2~1.EXE File opened for modification C:\Windows\directx.sys A96EF2~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys A96EF2~1.EXE File opened for modification C:\Windows\directx.sys A96EF2~1.EXE File opened for modification C:\Windows\directx.sys A96EF2~1.EXE File opened for modification C:\Windows\svchost.com A96EF2~1.EXE File opened for modification C:\Windows\directx.sys A96EF2~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys A96EF2~1.EXE File opened for modification C:\Windows\svchost.com A96EF2~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys A96EF2~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com A96EF2~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com A96EF2~1.EXE File opened for modification C:\Windows\svchost.com A96EF2~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com A96EF2~1.EXE File opened for modification C:\Windows\svchost.com A96EF2~1.EXE File opened for modification C:\Windows\directx.sys A96EF2~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys A96EF2~1.EXE File opened for modification C:\Windows\svchost.com A96EF2~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com A96EF2~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com A96EF2~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys A96EF2~1.EXE File opened for modification C:\Windows\directx.sys A96EF2~1.EXE File opened for modification C:\Windows\directx.sys A96EF2~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys A96EF2~1.EXE File opened for modification C:\Windows\directx.sys A96EF2~1.EXE File opened for modification C:\Windows\svchost.com A96EF2~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys A96EF2~1.EXE File opened for modification C:\Windows\directx.sys A96EF2~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com A96EF2~1.EXE File opened for modification C:\Windows\directx.sys A96EF2~1.EXE File opened for modification C:\Windows\svchost.com A96EF2~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys A96EF2~1.EXE File opened for modification C:\Windows\directx.sys A96EF2~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com A96EF2~1.EXE File opened for modification C:\Windows\directx.sys A96EF2~1.EXE File opened for modification C:\Windows\directx.sys A96EF2~1.EXE File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
A96EF2~1.EXEsvchost.comsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comsvchost.comsvchost.comA96EF2~1.EXEA96EF2~1.EXEsvchost.comsvchost.comsvchost.comA96EF2~1.EXEA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comsvchost.comA96EF2~1.EXEsvchost.comsvchost.comsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEA96EF2~1.EXEA96EF2~1.EXEsvchost.comA96EF2~1.EXEA96EF2~1.EXEsvchost.comsvchost.comsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEA96EF2~1.EXEA96EF2~1.EXEA96EF2~1.EXEsvchost.comsvchost.comA96EF2~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comA96EF2~1.EXEA96EF2~1.EXEA96EF2~1.EXEA96EF2~1.EXEsvchost.comA96EF2~1.EXEA96EF2~1.EXEA96EF2~1.EXEsvchost.comsvchost.comsvchost.comdescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A96EF2~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
Processes:
a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
A96EF2~1.EXEpid Process 2428 A96EF2~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exea96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exesvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEsvchost.comA96EF2~1.EXEdescription pid Process procid_target PID 3012 wrote to memory of 2960 3012 a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe 30 PID 3012 wrote to memory of 2960 3012 a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe 30 PID 3012 wrote to memory of 2960 3012 a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe 30 PID 3012 wrote to memory of 2960 3012 a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe 30 PID 2960 wrote to memory of 2956 2960 a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe 31 PID 2960 wrote to memory of 2956 2960 a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe 31 PID 2960 wrote to memory of 2956 2960 a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe 31 PID 2960 wrote to memory of 2956 2960 a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe 31 PID 2956 wrote to memory of 2804 2956 svchost.com 32 PID 2956 wrote to memory of 2804 2956 svchost.com 32 PID 2956 wrote to memory of 2804 2956 svchost.com 32 PID 2956 wrote to memory of 2804 2956 svchost.com 32 PID 2804 wrote to memory of 2940 2804 A96EF2~1.EXE 33 PID 2804 wrote to memory of 2940 2804 A96EF2~1.EXE 33 PID 2804 wrote to memory of 2940 2804 A96EF2~1.EXE 33 PID 2804 wrote to memory of 2940 2804 A96EF2~1.EXE 33 PID 2940 wrote to memory of 2788 2940 svchost.com 34 PID 2940 wrote to memory of 2788 2940 svchost.com 34 PID 2940 wrote to memory of 2788 2940 svchost.com 34 PID 2940 wrote to memory of 2788 2940 svchost.com 34 PID 2788 wrote to memory of 2472 2788 A96EF2~1.EXE 35 PID 2788 wrote to memory of 2472 2788 A96EF2~1.EXE 35 PID 2788 wrote to memory of 2472 2788 A96EF2~1.EXE 35 PID 2788 wrote to memory of 2472 2788 A96EF2~1.EXE 35 PID 2472 wrote to memory of 352 2472 svchost.com 70 PID 2472 wrote to memory of 352 2472 svchost.com 70 PID 2472 wrote to memory of 352 2472 svchost.com 70 PID 2472 wrote to memory of 352 2472 svchost.com 70 PID 352 wrote to memory of 1108 352 A96EF2~1.EXE 37 PID 352 wrote to memory of 1108 352 A96EF2~1.EXE 37 PID 352 wrote to memory of 1108 352 A96EF2~1.EXE 37 PID 352 wrote to memory of 1108 352 A96EF2~1.EXE 37 PID 1108 wrote to memory of 2884 1108 svchost.com 74 PID 1108 wrote to memory of 2884 1108 svchost.com 74 PID 1108 wrote to memory of 2884 1108 svchost.com 74 PID 1108 wrote to memory of 2884 1108 svchost.com 74 PID 2884 wrote to memory of 3068 2884 A96EF2~1.EXE 39 PID 2884 wrote to memory of 3068 2884 A96EF2~1.EXE 39 PID 2884 wrote to memory of 3068 2884 A96EF2~1.EXE 39 PID 2884 wrote to memory of 3068 2884 A96EF2~1.EXE 39 PID 3068 wrote to memory of 2220 3068 svchost.com 40 PID 3068 wrote to memory of 2220 3068 svchost.com 40 PID 3068 wrote to memory of 2220 3068 svchost.com 40 PID 3068 wrote to memory of 2220 3068 svchost.com 40 PID 2220 wrote to memory of 2340 2220 A96EF2~1.EXE 41 PID 2220 wrote to memory of 2340 2220 A96EF2~1.EXE 41 PID 2220 wrote to memory of 2340 2220 A96EF2~1.EXE 41 PID 2220 wrote to memory of 2340 2220 A96EF2~1.EXE 41 PID 2340 wrote to memory of 848 2340 svchost.com 42 PID 2340 wrote to memory of 848 2340 svchost.com 42 PID 2340 wrote to memory of 848 2340 svchost.com 42 PID 2340 wrote to memory of 848 2340 svchost.com 42 PID 848 wrote to memory of 1936 848 A96EF2~1.EXE 81 PID 848 wrote to memory of 1936 848 A96EF2~1.EXE 81 PID 848 wrote to memory of 1936 848 A96EF2~1.EXE 81 PID 848 wrote to memory of 1936 848 A96EF2~1.EXE 81 PID 1936 wrote to memory of 1856 1936 svchost.com 44 PID 1936 wrote to memory of 1856 1936 svchost.com 44 PID 1936 wrote to memory of 1856 1936 svchost.com 44 PID 1936 wrote to memory of 1856 1936 svchost.com 44 PID 1856 wrote to memory of 1888 1856 A96EF2~1.EXE 135 PID 1856 wrote to memory of 1888 1856 A96EF2~1.EXE 135 PID 1856 wrote to memory of 1888 1856 A96EF2~1.EXE 135 PID 1856 wrote to memory of 1888 1856 A96EF2~1.EXE 135
Processes
-
C:\Users\Admin\AppData\Local\Temp\a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe"C:\Users\Admin\AppData\Local\Temp\a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\3582-490\a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\a96ef24a628fd12d3c4c38263aaa6031071187eae4e6962142d8d9d217eabfdfN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:352 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE10⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE18⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:304 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1064 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE26⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1708 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:604 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE34⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1668 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE38⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2156 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE40⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1192 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"41⤵
- Executes dropped EXE
PID:696 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE42⤵
- Executes dropped EXE
PID:352 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"43⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE44⤵
- Executes dropped EXE
PID:1480 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"45⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE46⤵
- Executes dropped EXE
PID:2884 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"47⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE48⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:296 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"49⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE50⤵
- Executes dropped EXE
PID:2568 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"51⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE52⤵
- Executes dropped EXE
PID:664 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"53⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:400 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"55⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE56⤵
- Executes dropped EXE
PID:656 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"57⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE58⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2524 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"59⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE60⤵
- Executes dropped EXE
PID:2440 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"61⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE62⤵
- Executes dropped EXE
PID:1028 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"63⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE64⤵
- Executes dropped EXE
PID:1068 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"65⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE66⤵PID:1064
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"67⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE68⤵
- System Location Discovery: System Language Discovery
PID:2228 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"69⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE70⤵PID:688
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"71⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE72⤵
- System Location Discovery: System Language Discovery
PID:1156 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"73⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE74⤵
- Drops file in Windows directory
PID:1632 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"75⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE76⤵PID:2652
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"77⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE78⤵PID:2072
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"79⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE80⤵PID:2916
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"81⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE82⤵PID:1608
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"83⤵
- System Location Discovery: System Language Discovery
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE84⤵
- System Location Discovery: System Language Discovery
PID:2780 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"85⤵
- Drops file in Windows directory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE86⤵
- Drops file in Windows directory
PID:2744 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"87⤵
- System Location Discovery: System Language Discovery
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE88⤵PID:536
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"89⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE90⤵PID:768
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"91⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE92⤵PID:1660
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"93⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE94⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2448 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"95⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE96⤵PID:2884
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"97⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE98⤵
- System Location Discovery: System Language Discovery
PID:296 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"99⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE100⤵PID:2000
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"101⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE102⤵PID:1840
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"103⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE104⤵PID:2728
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"105⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE106⤵PID:2248
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"107⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE108⤵PID:2452
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"109⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE110⤵PID:3040
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"111⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE112⤵
- System Location Discovery: System Language Discovery
PID:1700 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"113⤵
- Drops file in Windows directory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE114⤵PID:2364
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"115⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE116⤵PID:1336
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"117⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE118⤵PID:1552
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"119⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE120⤵PID:1756
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A96EF2~1.EXE"121⤵PID:744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-