Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06-11-2024 15:17
Behavioral task
behavioral1
Sample
d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
120 seconds
Behavioral task
behavioral2
Sample
d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
120 seconds
General
-
Target
d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe
-
Size
561KB
-
MD5
6409a37baec16d51e2c601708fbd66f0
-
SHA1
12c3a691ce9f841881c02e77b5b5d57e956ada04
-
SHA256
d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0
-
SHA512
7e7063d6c7a3fa1dafecfb4f05a1beba4c5a6231a70522b59e7afe559415bf173c3627a727c434d69372140f918cd651bfacf83d4958a36602642feb208c80a2
-
SSDEEP
3072:sr85CIE5zrTTp8mlaySQe5gAX8vrMIsCwF5e5RH5jqaZ4FhKnTEFQapWpKvIu5ey:k9hrTTWy/e5AwnCo0H5jFi5UxGg+9
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
Processes:
resource yara_rule behavioral1/files/0x0008000000016d06-2.dat family_neshta behavioral1/files/0x0008000000016d0e-15.dat family_neshta behavioral1/files/0x0001000000010314-20.dat family_neshta behavioral1/files/0x0001000000010312-19.dat family_neshta behavioral1/files/0x001400000000f841-17.dat family_neshta behavioral1/files/0x0001000000010738-18.dat family_neshta behavioral1/memory/1148-31-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2744-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2872-43-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2248-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2644-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2264-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2776-80-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2648-79-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2200-95-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2712-94-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3004-101-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2204-100-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2896-118-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2980-117-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d8-113.dat family_neshta behavioral1/files/0x000100000000f7e6-131.dat family_neshta behavioral1/files/0x000100000000f703-136.dat family_neshta behavioral1/memory/2028-140-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3012-139-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2408-159-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/696-157-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1852-176-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2380-175-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2232-196-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1228-195-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1548-204-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1376-203-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2056-219-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2376-220-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/764-227-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2316-226-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1824-242-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1952-243-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1544-259-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1664-258-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2512-279-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2780-278-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2904-287-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2916-286-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2996-299-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2264-300-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2632-307-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2668-308-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2592-316-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1936-323-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1676-326-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2940-325-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2204-335-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2100-334-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2724-343-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2980-342-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2356-350-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2032-351-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2036-359-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3012-358-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/984-367-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1368-366-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/300-379-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
Processes:
d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exesvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.compid Process 1212 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 1148 svchost.com 2248 D7B51A~1.EXE 2744 svchost.com 2872 D7B51A~1.EXE 2644 svchost.com 2264 D7B51A~1.EXE 2776 svchost.com 2648 D7B51A~1.EXE 2712 svchost.com 2200 D7B51A~1.EXE 3004 svchost.com 2204 D7B51A~1.EXE 2896 svchost.com 2980 D7B51A~1.EXE 3012 svchost.com 2028 D7B51A~1.EXE 2408 svchost.com 696 D7B51A~1.EXE 2380 svchost.com 1852 D7B51A~1.EXE 2232 svchost.com 1228 D7B51A~1.EXE 1548 svchost.com 1376 D7B51A~1.EXE 2056 svchost.com 2376 D7B51A~1.EXE 2316 svchost.com 764 D7B51A~1.EXE 1824 svchost.com 1952 D7B51A~1.EXE 1544 svchost.com 1664 D7B51A~1.EXE 2512 svchost.com 2780 D7B51A~1.EXE 2904 svchost.com 2916 D7B51A~1.EXE 2996 svchost.com 2264 D7B51A~1.EXE 2632 svchost.com 2668 D7B51A~1.EXE 2592 svchost.com 1936 D7B51A~1.EXE 1676 svchost.com 2940 D7B51A~1.EXE 2204 svchost.com 2100 D7B51A~1.EXE 2724 svchost.com 2980 D7B51A~1.EXE 2032 svchost.com 2356 D7B51A~1.EXE 3012 svchost.com 2036 D7B51A~1.EXE 984 svchost.com 1368 D7B51A~1.EXE 300 svchost.com 2088 D7B51A~1.EXE 2432 svchost.com 1088 D7B51A~1.EXE 600 svchost.com 1096 D7B51A~1.EXE 340 svchost.com 1572 D7B51A~1.EXE 956 svchost.com -
Loads dropped DLL 64 IoCs
Processes:
d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comd7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exesvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.compid Process 2008 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 2008 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 1148 svchost.com 1148 svchost.com 2744 svchost.com 2744 svchost.com 2644 svchost.com 2644 svchost.com 2776 svchost.com 2776 svchost.com 2712 svchost.com 2712 svchost.com 3004 svchost.com 3004 svchost.com 2896 svchost.com 2896 svchost.com 3012 svchost.com 3012 svchost.com 2008 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 1212 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 1212 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 2408 svchost.com 2408 svchost.com 1212 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 2380 svchost.com 2380 svchost.com 2232 svchost.com 2232 svchost.com 1212 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 1212 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 1548 svchost.com 1548 svchost.com 2056 svchost.com 2056 svchost.com 2316 svchost.com 2316 svchost.com 1824 svchost.com 1824 svchost.com 1544 svchost.com 1544 svchost.com 1212 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 2512 svchost.com 2512 svchost.com 1212 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 1212 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 2904 svchost.com 2904 svchost.com 2996 svchost.com 2996 svchost.com 2632 svchost.com 2632 svchost.com 2592 svchost.com 2592 svchost.com 1676 svchost.com 1676 svchost.com 2204 svchost.com 2204 svchost.com 2724 svchost.com 2724 svchost.com 2032 svchost.com 2032 svchost.com 3012 svchost.com 3012 svchost.com 984 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exed7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exedescription ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe -
Drops file in Windows directory 64 IoCs
Processes:
svchost.comsvchost.comD7B51A~1.EXEsvchost.comsvchost.comsvchost.comD7B51A~1.EXED7B51A~1.EXEsvchost.comsvchost.comD7B51A~1.EXED7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comsvchost.comD7B51A~1.EXED7B51A~1.EXED7B51A~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comD7B51A~1.EXED7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comsvchost.comD7B51A~1.EXED7B51A~1.EXED7B51A~1.EXED7B51A~1.EXED7B51A~1.EXEsvchost.comD7B51A~1.EXED7B51A~1.EXED7B51A~1.EXED7B51A~1.EXED7B51A~1.EXEsvchost.comsvchost.comD7B51A~1.EXED7B51A~1.EXEsvchost.comsvchost.comD7B51A~1.EXED7B51A~1.EXED7B51A~1.EXEsvchost.comsvchost.comsvchost.comD7B51A~1.EXED7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comsvchost.comsvchost.comdescription ioc Process File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
svchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXED7B51A~1.EXED7B51A~1.EXED7B51A~1.EXEsvchost.comD7B51A~1.EXED7B51A~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comD7B51A~1.EXED7B51A~1.EXEsvchost.comsvchost.comD7B51A~1.EXED7B51A~1.EXED7B51A~1.EXEsvchost.comD7B51A~1.EXED7B51A~1.EXED7B51A~1.EXED7B51A~1.EXED7B51A~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comD7B51A~1.EXED7B51A~1.EXED7B51A~1.EXED7B51A~1.EXED7B51A~1.EXEsvchost.comsvchost.comD7B51A~1.EXED7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comsvchost.comsvchost.comD7B51A~1.EXED7B51A~1.EXED7B51A~1.EXED7B51A~1.EXED7B51A~1.EXED7B51A~1.EXED7B51A~1.EXEsvchost.comsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comD7B51A~1.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE -
Modifies registry class 1 IoCs
Processes:
d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
D7B51A~1.EXEpid Process 1828 D7B51A~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exed7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exesvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEsvchost.comD7B51A~1.EXEdescription pid Process procid_target PID 2008 wrote to memory of 1212 2008 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 30 PID 2008 wrote to memory of 1212 2008 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 30 PID 2008 wrote to memory of 1212 2008 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 30 PID 2008 wrote to memory of 1212 2008 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 30 PID 1212 wrote to memory of 1148 1212 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 31 PID 1212 wrote to memory of 1148 1212 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 31 PID 1212 wrote to memory of 1148 1212 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 31 PID 1212 wrote to memory of 1148 1212 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 31 PID 1148 wrote to memory of 2248 1148 svchost.com 32 PID 1148 wrote to memory of 2248 1148 svchost.com 32 PID 1148 wrote to memory of 2248 1148 svchost.com 32 PID 1148 wrote to memory of 2248 1148 svchost.com 32 PID 2248 wrote to memory of 2744 2248 D7B51A~1.EXE 33 PID 2248 wrote to memory of 2744 2248 D7B51A~1.EXE 33 PID 2248 wrote to memory of 2744 2248 D7B51A~1.EXE 33 PID 2248 wrote to memory of 2744 2248 D7B51A~1.EXE 33 PID 2744 wrote to memory of 2872 2744 svchost.com 34 PID 2744 wrote to memory of 2872 2744 svchost.com 34 PID 2744 wrote to memory of 2872 2744 svchost.com 34 PID 2744 wrote to memory of 2872 2744 svchost.com 34 PID 2872 wrote to memory of 2644 2872 D7B51A~1.EXE 35 PID 2872 wrote to memory of 2644 2872 D7B51A~1.EXE 35 PID 2872 wrote to memory of 2644 2872 D7B51A~1.EXE 35 PID 2872 wrote to memory of 2644 2872 D7B51A~1.EXE 35 PID 2644 wrote to memory of 2264 2644 svchost.com 68 PID 2644 wrote to memory of 2264 2644 svchost.com 68 PID 2644 wrote to memory of 2264 2644 svchost.com 68 PID 2644 wrote to memory of 2264 2644 svchost.com 68 PID 2264 wrote to memory of 2776 2264 D7B51A~1.EXE 37 PID 2264 wrote to memory of 2776 2264 D7B51A~1.EXE 37 PID 2264 wrote to memory of 2776 2264 D7B51A~1.EXE 37 PID 2264 wrote to memory of 2776 2264 D7B51A~1.EXE 37 PID 2776 wrote to memory of 2648 2776 svchost.com 38 PID 2776 wrote to memory of 2648 2776 svchost.com 38 PID 2776 wrote to memory of 2648 2776 svchost.com 38 PID 2776 wrote to memory of 2648 2776 svchost.com 38 PID 2648 wrote to memory of 2712 2648 D7B51A~1.EXE 39 PID 2648 wrote to memory of 2712 2648 D7B51A~1.EXE 39 PID 2648 wrote to memory of 2712 2648 D7B51A~1.EXE 39 PID 2648 wrote to memory of 2712 2648 D7B51A~1.EXE 39 PID 2712 wrote to memory of 2200 2712 svchost.com 40 PID 2712 wrote to memory of 2200 2712 svchost.com 40 PID 2712 wrote to memory of 2200 2712 svchost.com 40 PID 2712 wrote to memory of 2200 2712 svchost.com 40 PID 2200 wrote to memory of 3004 2200 D7B51A~1.EXE 41 PID 2200 wrote to memory of 3004 2200 D7B51A~1.EXE 41 PID 2200 wrote to memory of 3004 2200 D7B51A~1.EXE 41 PID 2200 wrote to memory of 3004 2200 D7B51A~1.EXE 41 PID 3004 wrote to memory of 2204 3004 svchost.com 75 PID 3004 wrote to memory of 2204 3004 svchost.com 75 PID 3004 wrote to memory of 2204 3004 svchost.com 75 PID 3004 wrote to memory of 2204 3004 svchost.com 75 PID 2204 wrote to memory of 2896 2204 D7B51A~1.EXE 43 PID 2204 wrote to memory of 2896 2204 D7B51A~1.EXE 43 PID 2204 wrote to memory of 2896 2204 D7B51A~1.EXE 43 PID 2204 wrote to memory of 2896 2204 D7B51A~1.EXE 43 PID 2896 wrote to memory of 2980 2896 svchost.com 124 PID 2896 wrote to memory of 2980 2896 svchost.com 124 PID 2896 wrote to memory of 2980 2896 svchost.com 124 PID 2896 wrote to memory of 2980 2896 svchost.com 124 PID 2980 wrote to memory of 3012 2980 D7B51A~1.EXE 127 PID 2980 wrote to memory of 3012 2980 D7B51A~1.EXE 127 PID 2980 wrote to memory of 3012 2980 D7B51A~1.EXE 127 PID 2980 wrote to memory of 3012 2980 D7B51A~1.EXE 127
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe"C:\Users\Admin\AppData\Local\Temp\d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\3582-490\d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE16⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE18⤵
- Executes dropped EXE
PID:2028 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE20⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:696 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE22⤵
- Executes dropped EXE
PID:1852 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE24⤵
- Executes dropped EXE
PID:1228 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE26⤵
- Executes dropped EXE
PID:1376 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE28⤵
- Executes dropped EXE
PID:2376 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE30⤵
- Executes dropped EXE
PID:764 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE32⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1952 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE34⤵
- Executes dropped EXE
PID:1664 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE36⤵
- Executes dropped EXE
PID:2780 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2916 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE40⤵
- Executes dropped EXE
PID:2264 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE42⤵
- Executes dropped EXE
PID:2668 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE44⤵
- Executes dropped EXE
PID:1936 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE46⤵
- Executes dropped EXE
PID:2940 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE48⤵
- Executes dropped EXE
PID:2100 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2980 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE52⤵
- Executes dropped EXE
PID:2356 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE56⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1368 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"57⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:300 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE58⤵
- Executes dropped EXE
PID:2088 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"59⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1088 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"61⤵
- Executes dropped EXE
PID:600 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1096 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:340 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE64⤵
- Executes dropped EXE
PID:1572 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:956 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE66⤵
- Drops file in Windows directory
PID:1276 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"67⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE68⤵
- System Location Discovery: System Language Discovery
PID:2504 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"69⤵
- Drops file in Windows directory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE70⤵PID:1816
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"71⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE72⤵PID:1808
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"73⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE74⤵
- System Location Discovery: System Language Discovery
PID:2568 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"75⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE76⤵PID:2820
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"77⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE78⤵PID:2276
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"79⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE80⤵PID:2072
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"81⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE82⤵
- System Location Discovery: System Language Discovery
PID:2916 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"83⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE84⤵PID:2996
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"85⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE86⤵PID:2648
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"87⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE88⤵PID:2592
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"89⤵
- System Location Discovery: System Language Discovery
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE90⤵PID:2876
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"91⤵
- System Location Discovery: System Language Discovery
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE92⤵PID:2932
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"93⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE94⤵PID:2992
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"95⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE96⤵PID:2980
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"97⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE98⤵PID:2112
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"99⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE100⤵
- Drops file in Windows directory
PID:2036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"101⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE102⤵PID:2424
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"103⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE104⤵PID:772
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"105⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE106⤵PID:1476
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"107⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE108⤵
- System Location Discovery: System Language Discovery
PID:2104 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"109⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE110⤵PID:2444
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"111⤵
- System Location Discovery: System Language Discovery
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE112⤵PID:2304
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"113⤵
- Drops file in Windows directory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE114⤵PID:1448
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"115⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE116⤵
- System Location Discovery: System Language Discovery
PID:844 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"117⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE118⤵
- System Location Discovery: System Language Discovery
PID:1512 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"119⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE120⤵PID:1984
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"121⤵
- System Location Discovery: System Language Discovery
PID:2488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-