Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 08:42
General
-
Target
Proxy.exe
-
Size
2.3MB
-
MD5
c2178d8b3bdcf1210181170012e95b83
-
SHA1
1a6e51b004c5384c0af7882229f6a949395d588a
-
SHA256
1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1
-
SHA512
c99ca875c22893d98bbb11fd70eacbad3e180e78f55abc9421db350db91c58428b52398678db0ccbfe9942ce9bf2775a61af9f1d709ca87c7f08c8b62c45fa5a
-
SSDEEP
24576:dFbkIsaPiXSVnC7Yp9zkNmZG8RRln4yzrIila8CfcX50Kew+IVWQPYwKBdzuyMrt:dREXSVMDi3w0aFIP+DwKnwhFltZ
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
-
Gh0st RAT payload 1 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 3 IoCs
-
Modifies system executable filetype association 2 TTPs 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 4 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Proxy.exe"C:\Users\Admin\AppData\Local\Temp\Proxy.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\Proxy.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\Proxy.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\look2.exeC:\Users\Admin\AppData\Local\Temp\\look2.exe3⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe7⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"10⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe13⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe15⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe19⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe21⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe23⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"24⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe25⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"26⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe27⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"28⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe29⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"30⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe31⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"32⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe33⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"34⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe35⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"36⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe37⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"38⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe39⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"40⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe41⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"42⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe43⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"44⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe45⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"46⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe47⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"48⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe49⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"50⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe51⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"54⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe55⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"56⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe57⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"58⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe59⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"60⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe61⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"62⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe63⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe65⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"66⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe67⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"68⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe69⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"70⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe71⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"72⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe73⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"74⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe75⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"76⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe77⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"78⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe79⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"80⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe81⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"82⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe83⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"84⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe85⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"86⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe87⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"88⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe89⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"90⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe91⤵
- Checks computer location settings
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"92⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe93⤵
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"94⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe95⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"96⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe97⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"98⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe99⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"100⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe101⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"102⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe103⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"104⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe105⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"106⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe107⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"108⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe109⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"110⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe111⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"112⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe113⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"114⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe115⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"116⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe117⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"118⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe119⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe"120⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_Proxy.exe121⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-