Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-11-2024 00:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe
Resource
win7-20240903-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe
-
Size
6.0MB
-
MD5
e7dda9ad078dd60ef757b2fe7f273df6
-
SHA1
730da0f3a6079b2587a3275ff8a987b55668b565
-
SHA256
7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6
-
SHA512
e41bd58ec4f5d89d8f600c2bc6a2469f451dd3d09c38e885d6563d9c74a776bd1b218e29ce4e7cdcff6385273fb530517787df385bc26a0e2e7ec6c9beeaa58c
-
SSDEEP
98304:42io0F6n4DKhOPqSUze/aEO0j514bP35GB2sB9mqq3zY+WziaHLwU9S2iZt:4A0pD8OPqZx0z64rB/8CiaHEU9SZt
Score
10/10
Malware Config
Signatures
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2412 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe 2496 svchost.com 2056 7C0E1B~1.EXE 2092 svchost.com 2800 7C0E1B~1.EXE 2692 svchost.com 2696 7C0E1B~1.EXE 2900 svchost.com 2580 7C0E1B~1.EXE 2544 svchost.com 1980 7C0E1B~1.EXE 1200 svchost.com 1992 7C0E1B~1.EXE 1904 svchost.com 2596 7C0E1B~1.EXE 2880 svchost.com 2636 7C0E1B~1.EXE 444 svchost.com 1928 7C0E1B~1.EXE 1304 svchost.com 1700 7C0E1B~1.EXE 1216 svchost.com 2400 7C0E1B~1.EXE 1464 svchost.com 2108 7C0E1B~1.EXE 2148 svchost.com 1708 7C0E1B~1.EXE 1312 svchost.com 2436 7C0E1B~1.EXE 264 svchost.com 2864 7C0E1B~1.EXE 2788 svchost.com 2816 7C0E1B~1.EXE 2800 svchost.com 2936 7C0E1B~1.EXE 2840 svchost.com 2848 7C0E1B~1.EXE 2536 svchost.com 592 7C0E1B~1.EXE 2600 svchost.com 2080 7C0E1B~1.EXE 708 svchost.com 1628 7C0E1B~1.EXE 2328 svchost.com 2484 7C0E1B~1.EXE 2344 svchost.com 2004 7C0E1B~1.EXE 1840 svchost.com 2768 7C0E1B~1.EXE 2760 svchost.com 2884 7C0E1B~1.EXE 2712 svchost.com 1212 7C0E1B~1.EXE 624 svchost.com 1776 7C0E1B~1.EXE 1656 svchost.com 1988 7C0E1B~1.EXE 3024 svchost.com 960 7C0E1B~1.EXE 1672 svchost.com 2144 7C0E1B~1.EXE 2192 svchost.com 2400 7C0E1B~1.EXE 2100 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 3044 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe 3044 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe 2496 svchost.com 2496 svchost.com 2092 svchost.com 2092 svchost.com 2692 svchost.com 2692 svchost.com 2900 svchost.com 2900 svchost.com 2544 svchost.com 2544 svchost.com 1200 svchost.com 1200 svchost.com 2412 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe 3044 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe 3044 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe 3044 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe 1904 svchost.com 1904 svchost.com 2880 svchost.com 2880 svchost.com 3044 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe 444 svchost.com 444 svchost.com 1304 svchost.com 1304 svchost.com 1216 svchost.com 1216 svchost.com 3044 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe 1464 svchost.com 1464 svchost.com 2148 svchost.com 2148 svchost.com 1312 svchost.com 1312 svchost.com 3044 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe 264 svchost.com 264 svchost.com 2788 svchost.com 2788 svchost.com 2800 svchost.com 2800 svchost.com 2840 svchost.com 2840 svchost.com 2536 svchost.com 2536 svchost.com 2600 svchost.com 2600 svchost.com 708 svchost.com 708 svchost.com 2328 svchost.com 2328 svchost.com 2344 svchost.com 2344 svchost.com 1840 svchost.com 1840 svchost.com 2760 svchost.com 2760 svchost.com 2712 svchost.com 2712 svchost.com 624 svchost.com 624 svchost.com 1656 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 400 7C0E1B~1.EXE -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys 7C0E1B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 7C0E1B~1.EXE File opened for modification C:\Windows\svchost.com 7C0E1B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 7C0E1B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 7C0E1B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 7C0E1B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 7C0E1B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 7C0E1B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 7C0E1B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 7C0E1B~1.EXE File opened for modification C:\Windows\svchost.com 7C0E1B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 7C0E1B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 7C0E1B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 7C0E1B~1.EXE File opened for modification C:\Windows\svchost.com 7C0E1B~1.EXE File opened for modification C:\Windows\svchost.com 7C0E1B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 7C0E1B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 7C0E1B~1.EXE File opened for modification C:\Windows\svchost.com 7C0E1B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 7C0E1B~1.EXE File opened for modification C:\Windows\directx.sys 7C0E1B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 7C0E1B~1.EXE File opened for modification C:\Windows\directx.sys 7C0E1B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 7C0E1B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 7C0E1B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 7C0E1B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 7C0E1B~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0E1B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "35" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\easy-firmware.com IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc500000000002000000000010660000000100002000000087d6961dfecd5b3760368cdf850f948c2bf9c4aad4174b7c84fa32f4339083b0000000000e8000000002000020000000ddcf8287fe06b99dc5026a1ded55200259f2f210ce46e8c1ab8f0a8c514a5d66900000000d445b5033e4128374a96764732e8df126b97ddd13eba3f496e384183745f74d9b74e120f06f4300c5ff790fb306154fa2161e8dc5f99c22f6e8fe840adbfe99cc1216f57410f1befc6db0ddc08182e7d29702a26bde763670371a49da0346f2d71982950d9cde5802925f92d456fcf5b0acb29176e0dfea27bd549c30b987ffbad07a387493dd585ceb9b6551ca52464000000041042d1e0456069cce21fba2afbb75ea5d2cad8167243ec378b4991d1d0c12759102fe100f62c98b269123d0b1619581d7436d968818ebc37c0125f5572560e2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "712" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\easy-firmware.com\ = "727" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "872" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{78788921-AAC4-11EF-A073-FA59FB4FA467} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\easy-firmware.com\Total = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\easy-firmware.com\ = "712" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000f5972f6c03f5f1966a233fbaca218bba08748f1871a593079f9d1022b014d18a000000000e800000000200002000000027a40cc4136f949aaf89ccad5d6c075d0e342de564318f6ca5c011ba41a09d4120000000b92d141da58a038d3bfc846de6e168c44e8b35056d45c720e7bc7dcfc02c92624000000074fe710056dc65862f93c24019a7c0f6498b1818b4185e4d30d9b4c53d8c01eb89592efc00fb2bb9ed723de666700a0f6cb914903ba554576643e039565fb239 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\easy-firmware.com\Total = "35" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438656496" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\easy-firmware.com\Total = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\easy-firmware.com\Total = "712" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\easy-firmware.com\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\easy-firmware.com\Total = "727" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\easy-firmware.com\ = "10" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70468e50d13edb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "727" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\easy-firmware.com\Total = "872" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\easy-firmware.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\easy-firmware.com\ = "35" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\easy-firmware.com\ = "872" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 400 7C0E1B~1.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 400 7C0E1B~1.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2644 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 400 7C0E1B~1.EXE 400 7C0E1B~1.EXE 400 7C0E1B~1.EXE 2644 iexplore.exe 2644 iexplore.exe 1868 IEXPLORE.EXE 1868 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2412 3044 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe 30 PID 3044 wrote to memory of 2412 3044 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe 30 PID 3044 wrote to memory of 2412 3044 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe 30 PID 3044 wrote to memory of 2412 3044 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe 30 PID 2412 wrote to memory of 2496 2412 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe 31 PID 2412 wrote to memory of 2496 2412 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe 31 PID 2412 wrote to memory of 2496 2412 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe 31 PID 2412 wrote to memory of 2496 2412 7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe 31 PID 2496 wrote to memory of 2056 2496 svchost.com 148 PID 2496 wrote to memory of 2056 2496 svchost.com 148 PID 2496 wrote to memory of 2056 2496 svchost.com 148 PID 2496 wrote to memory of 2056 2496 svchost.com 148 PID 2056 wrote to memory of 2092 2056 7C0E1B~1.EXE 33 PID 2056 wrote to memory of 2092 2056 7C0E1B~1.EXE 33 PID 2056 wrote to memory of 2092 2056 7C0E1B~1.EXE 33 PID 2056 wrote to memory of 2092 2056 7C0E1B~1.EXE 33 PID 2092 wrote to memory of 2800 2092 svchost.com 63 PID 2092 wrote to memory of 2800 2092 svchost.com 63 PID 2092 wrote to memory of 2800 2092 svchost.com 63 PID 2092 wrote to memory of 2800 2092 svchost.com 63 PID 2800 wrote to memory of 2692 2800 7C0E1B~1.EXE 35 PID 2800 wrote to memory of 2692 2800 7C0E1B~1.EXE 35 PID 2800 wrote to memory of 2692 2800 7C0E1B~1.EXE 35 PID 2800 wrote to memory of 2692 2800 7C0E1B~1.EXE 35 PID 2692 wrote to memory of 2696 2692 svchost.com 36 PID 2692 wrote to memory of 2696 2692 svchost.com 36 PID 2692 wrote to memory of 2696 2692 svchost.com 36 PID 2692 wrote to memory of 2696 2692 svchost.com 36 PID 2696 wrote to memory of 2900 2696 7C0E1B~1.EXE 37 PID 2696 wrote to memory of 2900 2696 7C0E1B~1.EXE 37 PID 2696 wrote to memory of 2900 2696 7C0E1B~1.EXE 37 PID 2696 wrote to memory of 2900 2696 7C0E1B~1.EXE 37 PID 2900 wrote to memory of 2580 2900 svchost.com 38 PID 2900 wrote to memory of 2580 2900 svchost.com 38 PID 2900 wrote to memory of 2580 2900 svchost.com 38 PID 2900 wrote to memory of 2580 2900 svchost.com 38 PID 2580 wrote to memory of 2544 2580 7C0E1B~1.EXE 39 PID 2580 wrote to memory of 2544 2580 7C0E1B~1.EXE 39 PID 2580 wrote to memory of 2544 2580 7C0E1B~1.EXE 39 PID 2580 wrote to memory of 2544 2580 7C0E1B~1.EXE 39 PID 2544 wrote to memory of 1980 2544 svchost.com 114 PID 2544 wrote to memory of 1980 2544 svchost.com 114 PID 2544 wrote to memory of 1980 2544 svchost.com 114 PID 2544 wrote to memory of 1980 2544 svchost.com 114 PID 1980 wrote to memory of 1200 1980 7C0E1B~1.EXE 77 PID 1980 wrote to memory of 1200 1980 7C0E1B~1.EXE 77 PID 1980 wrote to memory of 1200 1980 7C0E1B~1.EXE 77 PID 1980 wrote to memory of 1200 1980 7C0E1B~1.EXE 77 PID 1200 wrote to memory of 1992 1200 svchost.com 42 PID 1200 wrote to memory of 1992 1200 svchost.com 42 PID 1200 wrote to memory of 1992 1200 svchost.com 42 PID 1200 wrote to memory of 1992 1200 svchost.com 42 PID 1992 wrote to memory of 1904 1992 7C0E1B~1.EXE 212 PID 1992 wrote to memory of 1904 1992 7C0E1B~1.EXE 212 PID 1992 wrote to memory of 1904 1992 7C0E1B~1.EXE 212 PID 1992 wrote to memory of 1904 1992 7C0E1B~1.EXE 212 PID 1904 wrote to memory of 2596 1904 svchost.com 44 PID 1904 wrote to memory of 2596 1904 svchost.com 44 PID 1904 wrote to memory of 2596 1904 svchost.com 44 PID 1904 wrote to memory of 2596 1904 svchost.com 44 PID 2596 wrote to memory of 2880 2596 7C0E1B~1.EXE 214 PID 2596 wrote to memory of 2880 2596 7C0E1B~1.EXE 214 PID 2596 wrote to memory of 2880 2596 7C0E1B~1.EXE 214 PID 2596 wrote to memory of 2880 2596 7C0E1B~1.EXE 214
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe"C:\Users\Admin\AppData\Local\Temp\7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\7c0e1b66cb2f91b0927be6b270b05b519085b9c6d69947fb6a1fba6f4931cfd6.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE18⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2636 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:444 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE20⤵
- Executes dropped EXE
PID:1928 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE22⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1700 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE24⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2400 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2108 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE28⤵
- Executes dropped EXE
PID:1708 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE30⤵
- Executes dropped EXE
PID:2436 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:264 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE32⤵
- Executes dropped EXE
PID:2864 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE34⤵
- Executes dropped EXE
PID:2816 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE36⤵
- Executes dropped EXE
PID:2936 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE38⤵
- Executes dropped EXE
PID:2848 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE40⤵
- Executes dropped EXE
PID:592 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE42⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2080 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:708 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE44⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1628 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE46⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2484 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE48⤵
- Executes dropped EXE
PID:2004 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE50⤵
- Executes dropped EXE
PID:2768 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE52⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2884 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE54⤵
- Executes dropped EXE
PID:1212 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:624 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE56⤵
- Executes dropped EXE
PID:1776 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1988 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"59⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE60⤵
- Executes dropped EXE
PID:960 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"61⤵
- Executes dropped EXE
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE62⤵
- Executes dropped EXE
PID:2144 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE64⤵
- Executes dropped EXE
PID:2400 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE66⤵PID:2016
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"67⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE68⤵PID:2008
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"69⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE70⤵
- Drops file in Windows directory
PID:1000 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"71⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE72⤵PID:2376
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"73⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE74⤵PID:2056
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"75⤵
- System Location Discovery: System Language Discovery
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE76⤵
- Drops file in Windows directory
PID:2788 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"77⤵
- Drops file in Windows directory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE78⤵PID:2184
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"79⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE80⤵PID:1972
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"81⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE82⤵PID:2860
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"83⤵
- Drops file in Windows directory
PID:592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE84⤵PID:2592
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"85⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE86⤵PID:1976
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"87⤵
- Drops file in Windows directory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE88⤵PID:324
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"89⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE90⤵PID:2104
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"91⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE92⤵PID:1732
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"93⤵
- System Location Discovery: System Language Discovery
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE94⤵
- System Location Discovery: System Language Discovery
PID:380 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"95⤵
- Drops file in Windows directory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE96⤵PID:2780
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"97⤵
- System Location Discovery: System Language Discovery
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE98⤵
- Drops file in Windows directory
PID:2888 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"99⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE100⤵PID:1928
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"101⤵
- System Location Discovery: System Language Discovery
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE102⤵PID:1652
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"103⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE104⤵PID:920
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"105⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE106⤵PID:848
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"107⤵
- Drops file in Windows directory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE108⤵PID:2400
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"109⤵
- System Location Discovery: System Language Discovery
PID:584 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE110⤵PID:2016
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"111⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE112⤵PID:2252
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"113⤵
- System Location Discovery: System Language Discovery
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE114⤵PID:1536
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"115⤵
- Drops file in Windows directory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE116⤵
- System Location Discovery: System Language Discovery
PID:2436 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"117⤵
- Drops file in Windows directory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE118⤵
- Drops file in Windows directory
PID:2920 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"119⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE120⤵
- System Location Discovery: System Language Discovery
PID:2688 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\7C0E1B~1.EXE"121⤵
- System Location Discovery: System Language Discovery
PID:2788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-