Analysis
-
max time kernel
113s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2024, 15:17
Behavioral task
behavioral1
Sample
d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe
Resource
win10v2004-20241007-en
General
-
Target
d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe
-
Size
561KB
-
MD5
6409a37baec16d51e2c601708fbd66f0
-
SHA1
12c3a691ce9f841881c02e77b5b5d57e956ada04
-
SHA256
d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0
-
SHA512
7e7063d6c7a3fa1dafecfb4f05a1beba4c5a6231a70522b59e7afe559415bf173c3627a727c434d69372140f918cd651bfacf83d4958a36602642feb208c80a2
-
SSDEEP
3072:sr85CIE5zrTTp8mlaySQe5gAX8vrMIsCwF5e5RH5jqaZ4FhKnTEFQapWpKvIu5ey:k9hrTTWy/e5AwnCo0H5jFi5UxGg+9
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral2/files/0x000b000000023b8e-4.dat family_neshta behavioral2/files/0x000a000000023b92-10.dat family_neshta behavioral2/memory/1968-16-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1184-20-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/936-28-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2916-39-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1980-40-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/516-50-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/32-52-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2452-62-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4704-64-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/5020-68-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/396-76-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2496-80-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x0004000000020378-90.dat family_neshta behavioral2/files/0x000600000002024b-94.dat family_neshta behavioral2/files/0x00070000000202b3-93.dat family_neshta behavioral2/files/0x00010000000202dc-105.dat family_neshta behavioral2/files/0x000400000002033e-119.dat family_neshta behavioral2/files/0x00010000000202c4-118.dat family_neshta behavioral2/memory/4160-124-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x000100000002025a-101.dat family_neshta behavioral2/memory/1488-98-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/552-125-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x000600000002026a-128.dat family_neshta behavioral2/files/0x0001000000021564-141.dat family_neshta behavioral2/files/0x0002000000020342-139.dat family_neshta behavioral2/files/0x0001000000021510-150.dat family_neshta behavioral2/files/0x000100000002150f-149.dat family_neshta behavioral2/memory/2832-147-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x0001000000021511-153.dat family_neshta behavioral2/memory/908-154-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x0001000000022f6a-159.dat family_neshta behavioral2/files/0x0001000000022f6c-164.dat family_neshta behavioral2/files/0x0001000000022f6f-163.dat family_neshta behavioral2/files/0x00010000000167b7-170.dat family_neshta behavioral2/files/0x000100000001680c-177.dat family_neshta behavioral2/files/0x00010000000167f0-181.dat family_neshta behavioral2/files/0x000100000001dbde-184.dat family_neshta behavioral2/files/0x0001000000016809-168.dat family_neshta behavioral2/files/0x0001000000022ea9-198.dat family_neshta behavioral2/files/0x000100000001691e-197.dat family_neshta behavioral2/files/0x0001000000022f6e-158.dat family_neshta behavioral2/files/0x000300000001e8d0-207.dat family_neshta behavioral2/memory/1352-226-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1436-231-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/936-238-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4912-245-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3276-247-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4860-253-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2036-255-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3052-261-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1120-268-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4896-269-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/224-271-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1604-277-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4692-284-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/640-285-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1488-292-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4796-293-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3332-300-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4160-301-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/856-303-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4260-309-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation D7B51A~1.EXE -
Executes dropped EXE 64 IoCs
pid Process 4660 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 1968 svchost.com 1184 D7B51A~1.EXE 936 svchost.com 2916 D7B51A~1.EXE 1980 svchost.com 516 D7B51A~1.EXE 32 svchost.com 2452 D7B51A~1.EXE 4704 svchost.com 5020 D7B51A~1.EXE 396 svchost.com 2496 D7B51A~1.EXE 1488 svchost.com 4160 D7B51A~1.EXE 552 svchost.com 2832 D7B51A~1.EXE 908 svchost.com 1352 D7B51A~1.EXE 1436 svchost.com 936 D7B51A~1.EXE 4912 svchost.com 3276 D7B51A~1.EXE 4860 svchost.com 2036 D7B51A~1.EXE 3052 svchost.com 1120 D7B51A~1.EXE 4896 svchost.com 224 D7B51A~1.EXE 1604 svchost.com 4692 D7B51A~1.EXE 640 svchost.com 1488 D7B51A~1.EXE 4796 svchost.com 3332 D7B51A~1.EXE 4160 svchost.com 856 D7B51A~1.EXE 4260 svchost.com 3572 D7B51A~1.EXE 3328 svchost.com 3280 D7B51A~1.EXE 4012 svchost.com 2280 D7B51A~1.EXE 1040 svchost.com 3660 D7B51A~1.EXE 4476 svchost.com 2408 D7B51A~1.EXE 5016 svchost.com 5052 D7B51A~1.EXE 2776 svchost.com 2432 D7B51A~1.EXE 2264 svchost.com 4356 D7B51A~1.EXE 4928 svchost.com 1444 D7B51A~1.EXE 3136 svchost.com 3272 D7B51A~1.EXE 4704 svchost.com 2036 D7B51A~1.EXE 1128 svchost.com 3016 D7B51A~1.EXE 3624 svchost.com 2240 D7B51A~1.EXE 224 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MI9C33~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MI9C33~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~3.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\svchost.com d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\directx.sys D7B51A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com D7B51A~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys D7B51A~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B51A~1.EXE -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings D7B51A~1.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3060 D7B51A~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4640 wrote to memory of 4660 4640 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 84 PID 4640 wrote to memory of 4660 4640 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 84 PID 4640 wrote to memory of 4660 4640 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 84 PID 4660 wrote to memory of 1968 4660 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 85 PID 4660 wrote to memory of 1968 4660 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 85 PID 4660 wrote to memory of 1968 4660 d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe 85 PID 1968 wrote to memory of 1184 1968 svchost.com 86 PID 1968 wrote to memory of 1184 1968 svchost.com 86 PID 1968 wrote to memory of 1184 1968 svchost.com 86 PID 1184 wrote to memory of 936 1184 D7B51A~1.EXE 105 PID 1184 wrote to memory of 936 1184 D7B51A~1.EXE 105 PID 1184 wrote to memory of 936 1184 D7B51A~1.EXE 105 PID 936 wrote to memory of 2916 936 svchost.com 88 PID 936 wrote to memory of 2916 936 svchost.com 88 PID 936 wrote to memory of 2916 936 svchost.com 88 PID 2916 wrote to memory of 1980 2916 D7B51A~1.EXE 89 PID 2916 wrote to memory of 1980 2916 D7B51A~1.EXE 89 PID 2916 wrote to memory of 1980 2916 D7B51A~1.EXE 89 PID 1980 wrote to memory of 516 1980 svchost.com 90 PID 1980 wrote to memory of 516 1980 svchost.com 90 PID 1980 wrote to memory of 516 1980 svchost.com 90 PID 516 wrote to memory of 32 516 D7B51A~1.EXE 91 PID 516 wrote to memory of 32 516 D7B51A~1.EXE 91 PID 516 wrote to memory of 32 516 D7B51A~1.EXE 91 PID 32 wrote to memory of 2452 32 svchost.com 92 PID 32 wrote to memory of 2452 32 svchost.com 92 PID 32 wrote to memory of 2452 32 svchost.com 92 PID 2452 wrote to memory of 4704 2452 D7B51A~1.EXE 143 PID 2452 wrote to memory of 4704 2452 D7B51A~1.EXE 143 PID 2452 wrote to memory of 4704 2452 D7B51A~1.EXE 143 PID 4704 wrote to memory of 5020 4704 svchost.com 94 PID 4704 wrote to memory of 5020 4704 svchost.com 94 PID 4704 wrote to memory of 5020 4704 svchost.com 94 PID 5020 wrote to memory of 396 5020 D7B51A~1.EXE 95 PID 5020 wrote to memory of 396 5020 D7B51A~1.EXE 95 PID 5020 wrote to memory of 396 5020 D7B51A~1.EXE 95 PID 396 wrote to memory of 2496 396 svchost.com 96 PID 396 wrote to memory of 2496 396 svchost.com 96 PID 396 wrote to memory of 2496 396 svchost.com 96 PID 2496 wrote to memory of 1488 2496 D7B51A~1.EXE 153 PID 2496 wrote to memory of 1488 2496 D7B51A~1.EXE 153 PID 2496 wrote to memory of 1488 2496 D7B51A~1.EXE 153 PID 1488 wrote to memory of 4160 1488 svchost.com 121 PID 1488 wrote to memory of 4160 1488 svchost.com 121 PID 1488 wrote to memory of 4160 1488 svchost.com 121 PID 4160 wrote to memory of 552 4160 D7B51A~1.EXE 100 PID 4160 wrote to memory of 552 4160 D7B51A~1.EXE 100 PID 4160 wrote to memory of 552 4160 D7B51A~1.EXE 100 PID 552 wrote to memory of 2832 552 svchost.com 101 PID 552 wrote to memory of 2832 552 svchost.com 101 PID 552 wrote to memory of 2832 552 svchost.com 101 PID 2832 wrote to memory of 908 2832 D7B51A~1.EXE 102 PID 2832 wrote to memory of 908 2832 D7B51A~1.EXE 102 PID 2832 wrote to memory of 908 2832 D7B51A~1.EXE 102 PID 908 wrote to memory of 1352 908 svchost.com 209 PID 908 wrote to memory of 1352 908 svchost.com 209 PID 908 wrote to memory of 1352 908 svchost.com 209 PID 1352 wrote to memory of 1436 1352 D7B51A~1.EXE 104 PID 1352 wrote to memory of 1436 1352 D7B51A~1.EXE 104 PID 1352 wrote to memory of 1436 1352 D7B51A~1.EXE 104 PID 1436 wrote to memory of 936 1436 svchost.com 176 PID 1436 wrote to memory of 936 1436 svchost.com 176 PID 1436 wrote to memory of 936 1436 svchost.com 176 PID 936 wrote to memory of 4912 936 D7B51A~1.EXE 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe"C:\Users\Admin\AppData\Local\Temp\d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\3582-490\d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\d7b51ade94570af846beb9fff79524153e2efe0adc3b7f1fe24d0a0149560bd0N.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE8⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE10⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE14⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE16⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE20⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"23⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE24⤵
- Executes dropped EXE
PID:3276 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"27⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE28⤵
- Executes dropped EXE
PID:1120 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE30⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:224 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"31⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE32⤵
- Checks computer location settings
- Executes dropped EXE
PID:4692 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"33⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE34⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1488 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"35⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE36⤵
- Executes dropped EXE
PID:3332 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"37⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE38⤵
- Executes dropped EXE
- Modifies registry class
PID:856 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"39⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE40⤵
- Executes dropped EXE
PID:3572 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"41⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE42⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3280 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"43⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE44⤵
- Checks computer location settings
- Executes dropped EXE
PID:2280 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"45⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE46⤵
- Executes dropped EXE
PID:3660 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"47⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE48⤵
- Executes dropped EXE
PID:2408 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"49⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE50⤵
- Executes dropped EXE
- Modifies registry class
PID:5052 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"51⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE52⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2432 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE54⤵
- Executes dropped EXE
PID:4356 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"55⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE56⤵
- Executes dropped EXE
PID:1444 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"57⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE58⤵
- Executes dropped EXE
PID:3272 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"59⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE60⤵
- Executes dropped EXE
PID:2036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"61⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE62⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3016 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"63⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE64⤵
- Checks computer location settings
- Executes dropped EXE
PID:2240 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:224 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE66⤵
- Checks computer location settings
PID:4708 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"67⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE68⤵
- Checks computer location settings
PID:3212 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"69⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE70⤵
- Modifies registry class
PID:3620 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"71⤵
- System Location Discovery: System Language Discovery
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE72⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3916 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"73⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE74⤵
- Checks computer location settings
- Drops file in Windows directory
PID:2884 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"75⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE76⤵
- Checks computer location settings
PID:4444 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"77⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE78⤵
- Modifies registry class
PID:4012 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"79⤵
- Drops file in Windows directory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE80⤵
- Checks computer location settings
PID:4388 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"81⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE82⤵PID:540
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"83⤵
- System Location Discovery: System Language Discovery
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE84⤵PID:4824
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"85⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE86⤵PID:1676
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"87⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE88⤵
- Modifies registry class
PID:3296 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"89⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE90⤵
- Checks computer location settings
PID:936 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"91⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE92⤵
- Checks computer location settings
PID:4684 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"93⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE94⤵PID:1692
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"95⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE96⤵
- System Location Discovery: System Language Discovery
PID:3264 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"97⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE98⤵PID:696
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"99⤵
- System Location Discovery: System Language Discovery
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE100⤵
- Modifies registry class
PID:2096 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"101⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE102⤵
- Checks computer location settings
- Drops file in Windows directory
PID:3624 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"103⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE104⤵
- Modifies registry class
PID:2100 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"105⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE106⤵PID:3204
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"107⤵
- Drops file in Windows directory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE108⤵
- Modifies registry class
PID:1808 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"109⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE110⤵
- Checks computer location settings
- Drops file in Windows directory
PID:5072 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"111⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE112⤵
- Modifies registry class
PID:60 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"113⤵
- Drops file in Windows directory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE114⤵PID:856
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"115⤵
- Drops file in Windows directory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE116⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1420 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"117⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE118⤵
- Checks computer location settings
PID:4428 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"119⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE120⤵
- Modifies registry class
PID:2720 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE"121⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\D7B51A~1.EXE122⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-