Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 08:42
Behavioral task
behavioral1
Sample
Proxy.exe
Resource
win7-20240903-en
windows7-x64
20 signatures
150 seconds
General
-
Target
Proxy.exe
-
Size
2.3MB
-
MD5
c2178d8b3bdcf1210181170012e95b83
-
SHA1
1a6e51b004c5384c0af7882229f6a949395d588a
-
SHA256
1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1
-
SHA512
c99ca875c22893d98bbb11fd70eacbad3e180e78f55abc9421db350db91c58428b52398678db0ccbfe9942ce9bf2775a61af9f1d709ca87c7f08c8b62c45fa5a
-
SSDEEP
24576:dFbkIsaPiXSVnC7Yp9zkNmZG8RRln4yzrIila8CfcX50Kew+IVWQPYwKBdzuyMrt:dREXSVMDi3w0aFIP+DwKnwhFltZ
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x000800000001662e-2.dat family_neshta behavioral1/files/0x0001000000010314-10.dat family_neshta behavioral1/files/0x00060000000173f1-27.dat family_neshta behavioral1/files/0x0008000000016855-47.dat family_neshta behavioral1/files/0x0001000000010312-59.dat family_neshta behavioral1/files/0x000100000001070c-58.dat family_neshta behavioral1/files/0x00010000000107e5-57.dat family_neshta behavioral1/files/0x000100000000f7d3-63.dat family_neshta behavioral1/memory/2620-62-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d8-64.dat family_neshta behavioral1/files/0x000100000000f7e6-71.dat family_neshta behavioral1/files/0x000100000000f82d-77.dat family_neshta behavioral1/files/0x000100000000f703-76.dat family_neshta behavioral1/memory/2884-82-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x0001000000010366-100.dat family_neshta behavioral1/memory/2012-101-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x0001000000010c12-103.dat family_neshta behavioral1/files/0x00010000000117fc-105.dat family_neshta behavioral1/files/0x0001000000011a18-116.dat family_neshta behavioral1/files/0x00010000000118ea-115.dat family_neshta behavioral1/files/0x00010000000118e3-114.dat family_neshta behavioral1/files/0x0001000000011876-113.dat family_neshta behavioral1/files/0x0001000000010f30-112.dat family_neshta behavioral1/files/0x0001000000011b57-134.dat family_neshta behavioral1/memory/2768-132-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x00010000000108f6-136.dat family_neshta behavioral1/files/0x000300000001215d-141.dat family_neshta behavioral1/files/0x000300000001215c-140.dat family_neshta behavioral1/files/0x0003000000012159-143.dat family_neshta behavioral1/memory/1156-149-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2316-155-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1624-169-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2572-185-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1752-201-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1544-211-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2000-212-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1852-219-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2504-226-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1672-229-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2952-235-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1796-242-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1556-243-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2404-250-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2540-251-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/840-258-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2812-259-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2628-266-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2756-267-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2644-274-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2836-275-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1368-282-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/980-283-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2848-285-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2012-291-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2964-298-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2228-299-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3056-303-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2232-309-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1640-314-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2076-315-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1668-317-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1068-323-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3016-325-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/948-331-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x0007000000016c7b-17.dat family_gh0strat -
Gh0strat family
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\259430317.bat" look2.exe -
Executes dropped EXE 64 IoCs
pid Process 2128 Proxy.exe 2520 look2.exe 2776 HD_Proxy.exe 2620 svchost.com 2884 HD_Proxy.exe 2012 svchost.com 2768 HD_Proxy.exe 1156 svchost.com 2316 HD_Proxy.exe 1624 svchost.com 2572 HD_Proxy.exe 1752 svchost.com 1544 HD_Proxy.exe 2000 svchost.com 1852 HD_Proxy.exe 2504 svchost.com 1672 HD_Proxy.exe 2952 svchost.com 1796 HD_Proxy.exe 1556 svchost.com 2404 HD_Proxy.exe 2540 svchost.com 840 HD_Proxy.exe 2812 svchost.com 2628 HD_Proxy.exe 2756 svchost.com 2644 HD_Proxy.exe 2836 svchost.com 1368 HD_Proxy.exe 980 svchost.com 2848 HD_Proxy.exe 2012 svchost.com 2964 HD_Proxy.exe 2228 svchost.com 3056 HD_Proxy.exe 1028 svchcst.exe 2232 svchost.com 1640 HD_Proxy.exe 2076 svchost.com 1668 HD_Proxy.exe 1068 svchost.com 3016 HD_Proxy.exe 948 svchost.com 1960 HD_Proxy.exe 2036 svchost.com 1872 HD_Proxy.exe 944 svchost.com 2124 HD_Proxy.exe 2104 svchost.com 1420 HD_Proxy.exe 852 svchost.com 2444 HD_Proxy.exe 2016 svchost.com 1748 HD_Proxy.exe 2400 svchost.com 1596 HD_Proxy.exe 1684 svchost.com 2116 HD_Proxy.exe 1972 svchost.com 2896 HD_Proxy.exe 2800 svchost.com 2620 HD_Proxy.exe 2852 svchost.com 2644 HD_Proxy.exe -
Loads dropped DLL 64 IoCs
pid Process 812 Proxy.exe 2128 Proxy.exe 2520 look2.exe 2260 svchost.exe 2128 Proxy.exe 2128 Proxy.exe 2620 svchost.com 2620 svchost.com 2776 HD_Proxy.exe 812 Proxy.exe 812 Proxy.exe 2776 HD_Proxy.exe 2012 svchost.com 2012 svchost.com 2776 HD_Proxy.exe 2776 HD_Proxy.exe 1156 svchost.com 1156 svchost.com 2776 HD_Proxy.exe 2776 HD_Proxy.exe 2776 HD_Proxy.exe 1624 svchost.com 1624 svchost.com 2776 HD_Proxy.exe 2776 HD_Proxy.exe 2776 HD_Proxy.exe 1752 svchost.com 1752 svchost.com 2776 HD_Proxy.exe 2776 HD_Proxy.exe 2000 svchost.com 2000 svchost.com 2504 svchost.com 2504 svchost.com 2952 svchost.com 2952 svchost.com 1556 svchost.com 1556 svchost.com 2540 svchost.com 2540 svchost.com 2812 svchost.com 2812 svchost.com 2756 svchost.com 2756 svchost.com 2836 svchost.com 2836 svchost.com 980 svchost.com 980 svchost.com 2012 svchost.com 2012 svchost.com 2228 svchost.com 2228 svchost.com 2260 svchost.exe 1028 svchcst.exe 2232 svchost.com 2232 svchost.com 2076 svchost.com 2076 svchost.com 1068 svchost.com 1068 svchost.com 948 svchost.com 948 svchost.com 2036 svchost.com 2036 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Proxy.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ini.ini look2.exe File created C:\Windows\SysWOW64\svchcst.exe svchost.exe File opened for modification C:\Windows\SysWOW64\svchcst.exe svchost.exe File created C:\Windows\SysWOW64\259430317.bat look2.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe HD_Proxy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE Proxy.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe Proxy.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe HD_Proxy.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE Proxy.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE HD_Proxy.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe HD_Proxy.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE HD_Proxy.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe Proxy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE HD_Proxy.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe Proxy.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe HD_Proxy.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE Proxy.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe HD_Proxy.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE Proxy.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE Proxy.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe Proxy.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe HD_Proxy.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE HD_Proxy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE Proxy.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE Proxy.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE Proxy.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe Proxy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE Proxy.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe Proxy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE HD_Proxy.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe Proxy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE Proxy.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe HD_Proxy.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe Proxy.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE Proxy.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe HD_Proxy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE Proxy.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe Proxy.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE HD_Proxy.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE Proxy.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE HD_Proxy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE Proxy.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe Proxy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE Proxy.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE HD_Proxy.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe Proxy.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE Proxy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE Proxy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE HD_Proxy.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE HD_Proxy.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE Proxy.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe Proxy.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE Proxy.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE Proxy.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE HD_Proxy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE Proxy.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe HD_Proxy.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe Proxy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE HD_Proxy.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe HD_Proxy.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe Proxy.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe HD_Proxy.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE Proxy.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe Proxy.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe HD_Proxy.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE HD_Proxy.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe Proxy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE Proxy.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com HD_Proxy.exe File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com HD_Proxy.exe File opened for modification C:\Windows\svchost.com HD_Proxy.exe File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com HD_Proxy.exe File opened for modification C:\Windows\directx.sys HD_Proxy.exe File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com HD_Proxy.exe File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com HD_Proxy.exe File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys HD_Proxy.exe File opened for modification C:\Windows\directx.sys HD_Proxy.exe File opened for modification C:\Windows\svchost.com HD_Proxy.exe File opened for modification C:\Windows\svchost.com HD_Proxy.exe File opened for modification C:\Windows\directx.sys HD_Proxy.exe File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com HD_Proxy.exe File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys HD_Proxy.exe File opened for modification C:\Windows\svchost.com HD_Proxy.exe File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com HD_Proxy.exe File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys HD_Proxy.exe File opened for modification C:\Windows\svchost.com Proxy.exe File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com HD_Proxy.exe File opened for modification C:\Windows\directx.sys HD_Proxy.exe File opened for modification C:\Windows\svchost.com HD_Proxy.exe File opened for modification C:\Windows\directx.sys HD_Proxy.exe File opened for modification C:\Windows\svchost.com HD_Proxy.exe File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys HD_Proxy.exe File opened for modification C:\Windows\svchost.com HD_Proxy.exe File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys HD_Proxy.exe File opened for modification C:\Windows\directx.sys HD_Proxy.exe File opened for modification C:\Windows\svchost.com HD_Proxy.exe File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys HD_Proxy.exe File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys HD_Proxy.exe File opened for modification C:\Windows\directx.sys HD_Proxy.exe File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com HD_Proxy.exe File opened for modification C:\Windows\svchost.com HD_Proxy.exe File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_Proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_Proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_Proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_Proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_Proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_Proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_Proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_Proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_Proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_Proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_Proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_Proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_Proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_Proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_Proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_Proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_Proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_Proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_Proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_Proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_Proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_Proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_Proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_Proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_Proxy.exe -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Proxy.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2128 Proxy.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2128 Proxy.exe 2128 Proxy.exe 3020 HD_Proxy.exe 3020 HD_Proxy.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 812 wrote to memory of 2128 812 Proxy.exe 30 PID 812 wrote to memory of 2128 812 Proxy.exe 30 PID 812 wrote to memory of 2128 812 Proxy.exe 30 PID 812 wrote to memory of 2128 812 Proxy.exe 30 PID 2128 wrote to memory of 2520 2128 Proxy.exe 31 PID 2128 wrote to memory of 2520 2128 Proxy.exe 31 PID 2128 wrote to memory of 2520 2128 Proxy.exe 31 PID 2128 wrote to memory of 2520 2128 Proxy.exe 31 PID 2128 wrote to memory of 2776 2128 Proxy.exe 34 PID 2128 wrote to memory of 2776 2128 Proxy.exe 34 PID 2128 wrote to memory of 2776 2128 Proxy.exe 34 PID 2128 wrote to memory of 2776 2128 Proxy.exe 34 PID 2776 wrote to memory of 2620 2776 HD_Proxy.exe 35 PID 2776 wrote to memory of 2620 2776 HD_Proxy.exe 35 PID 2776 wrote to memory of 2620 2776 HD_Proxy.exe 35 PID 2776 wrote to memory of 2620 2776 HD_Proxy.exe 35 PID 2620 wrote to memory of 2884 2620 svchost.com 36 PID 2620 wrote to memory of 2884 2620 svchost.com 36 PID 2620 wrote to memory of 2884 2620 svchost.com 36 PID 2620 wrote to memory of 2884 2620 svchost.com 36 PID 2884 wrote to memory of 2012 2884 HD_Proxy.exe 63 PID 2884 wrote to memory of 2012 2884 HD_Proxy.exe 63 PID 2884 wrote to memory of 2012 2884 HD_Proxy.exe 63 PID 2884 wrote to memory of 2012 2884 HD_Proxy.exe 63 PID 2012 wrote to memory of 2768 2012 svchost.com 38 PID 2012 wrote to memory of 2768 2012 svchost.com 38 PID 2012 wrote to memory of 2768 2012 svchost.com 38 PID 2012 wrote to memory of 2768 2012 svchost.com 38 PID 2768 wrote to memory of 1156 2768 HD_Proxy.exe 39 PID 2768 wrote to memory of 1156 2768 HD_Proxy.exe 39 PID 2768 wrote to memory of 1156 2768 HD_Proxy.exe 39 PID 2768 wrote to memory of 1156 2768 HD_Proxy.exe 39 PID 1156 wrote to memory of 2316 1156 svchost.com 40 PID 1156 wrote to memory of 2316 1156 svchost.com 40 PID 1156 wrote to memory of 2316 1156 svchost.com 40 PID 1156 wrote to memory of 2316 1156 svchost.com 40 PID 2316 wrote to memory of 1624 2316 HD_Proxy.exe 41 PID 2316 wrote to memory of 1624 2316 HD_Proxy.exe 41 PID 2316 wrote to memory of 1624 2316 HD_Proxy.exe 41 PID 2316 wrote to memory of 1624 2316 HD_Proxy.exe 41 PID 1624 wrote to memory of 2572 1624 svchost.com 42 PID 1624 wrote to memory of 2572 1624 svchost.com 42 PID 1624 wrote to memory of 2572 1624 svchost.com 42 PID 1624 wrote to memory of 2572 1624 svchost.com 42 PID 2572 wrote to memory of 1752 2572 HD_Proxy.exe 43 PID 2572 wrote to memory of 1752 2572 HD_Proxy.exe 43 PID 2572 wrote to memory of 1752 2572 HD_Proxy.exe 43 PID 2572 wrote to memory of 1752 2572 HD_Proxy.exe 43 PID 1752 wrote to memory of 1544 1752 svchost.com 44 PID 1752 wrote to memory of 1544 1752 svchost.com 44 PID 1752 wrote to memory of 1544 1752 svchost.com 44 PID 1752 wrote to memory of 1544 1752 svchost.com 44 PID 1544 wrote to memory of 2000 1544 HD_Proxy.exe 114 PID 1544 wrote to memory of 2000 1544 HD_Proxy.exe 114 PID 1544 wrote to memory of 2000 1544 HD_Proxy.exe 114 PID 1544 wrote to memory of 2000 1544 HD_Proxy.exe 114 PID 2000 wrote to memory of 1852 2000 svchost.com 46 PID 2000 wrote to memory of 1852 2000 svchost.com 46 PID 2000 wrote to memory of 1852 2000 svchost.com 46 PID 2000 wrote to memory of 1852 2000 svchost.com 46 PID 1852 wrote to memory of 2504 1852 HD_Proxy.exe 47 PID 1852 wrote to memory of 2504 1852 HD_Proxy.exe 47 PID 1852 wrote to memory of 2504 1852 HD_Proxy.exe 47 PID 1852 wrote to memory of 2504 1852 HD_Proxy.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\Proxy.exe"C:\Users\Admin\AppData\Local\Temp\Proxy.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\3582-490\Proxy.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\Proxy.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\look2.exeC:\Users\Admin\AppData\Local\Temp\\look2.exe3⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2520
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe17⤵
- Executes dropped EXE
PID:1672 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe19⤵
- Executes dropped EXE
PID:1796 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"20⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe21⤵
- Executes dropped EXE
PID:2404 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe23⤵
- Executes dropped EXE
PID:840 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe25⤵
- Executes dropped EXE
PID:2628 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2644 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1368 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"30⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:980 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2848 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"32⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe33⤵
- Executes dropped EXE
PID:2964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"34⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3056 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe37⤵
- Executes dropped EXE
PID:1640 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe39⤵
- Executes dropped EXE
PID:1668 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe41⤵
- Executes dropped EXE
PID:3016 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe43⤵
- Executes dropped EXE
PID:1960 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe45⤵
- Executes dropped EXE
PID:1872 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"46⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2124 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"48⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1420 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:852 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2444 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"52⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1748 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"54⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe55⤵
- Executes dropped EXE
PID:1596 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"56⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe57⤵
- Executes dropped EXE
PID:2116 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2896 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2620 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"62⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe63⤵
- Executes dropped EXE
PID:2644 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"64⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe65⤵PID:1092
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"66⤵
- Drops file in Windows directory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe67⤵PID:1072
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"68⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe69⤵PID:2224
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"70⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe71⤵PID:2280
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"72⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe73⤵PID:1640
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"74⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe75⤵
- System Location Discovery: System Language Discovery
PID:2804 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"76⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe77⤵PID:1148
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"78⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe79⤵PID:1532
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"80⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe81⤵PID:1120
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"82⤵
- System Location Discovery: System Language Discovery
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe83⤵PID:2424
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"84⤵
- Drops file in Windows directory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe85⤵
- System Location Discovery: System Language Discovery
PID:1420 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"86⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe87⤵PID:1672
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"88⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe89⤵
- Drops file in Windows directory
PID:1308 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"90⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe91⤵PID:2404
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"92⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe93⤵
- Drops file in Windows directory
PID:2860 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"94⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe95⤵
- Drops file in Windows directory
PID:2716 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"96⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe97⤵PID:2592
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"98⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe99⤵PID:2580
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"100⤵
- System Location Discovery: System Language Discovery
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe101⤵
- Drops file in Windows directory
PID:2848 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"102⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe103⤵PID:1868
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"104⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe105⤵
- System Location Discovery: System Language Discovery
PID:2652 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"106⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe107⤵
- Drops file in Windows directory
PID:2092 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"108⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe109⤵PID:592
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"110⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe111⤵
- Drops file in Windows directory
PID:1600 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"112⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe113⤵PID:2248
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"114⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe115⤵
- Drops file in Windows directory
PID:1648 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"116⤵
- System Location Discovery: System Language Discovery
PID:944 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe117⤵PID:1940
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"118⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe119⤵
- Drops file in Windows directory
PID:1268 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"120⤵
- Drops file in Windows directory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe121⤵PID:1928
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-