Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-11-2024 20:39
Behavioral task
behavioral1
Sample
06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
120 seconds
General
-
Target
06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe
-
Size
173KB
-
MD5
739342ecd4ceea0512023b97ed456190
-
SHA1
3378f803fba9a33fef691d5b5a8db906af8732b9
-
SHA256
06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13
-
SHA512
c1338f28c652545982ece4097a850d97978730ee1ed4b970583db679a653319dcb7512d286219a54a8734d6664862313973c878067edc35c12273866b14fd25e
-
SSDEEP
3072:sr85CVooxlgKfSndp0CZtMHpz68Ab7jr85C:k9VFgKadJxD9
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0008000000015d64-2.dat family_neshta behavioral1/files/0x0008000000015d6d-15.dat family_neshta behavioral1/files/0x0001000000010314-25.dat family_neshta behavioral1/files/0x0001000000010312-24.dat family_neshta behavioral1/files/0x0013000000010321-18.dat family_neshta behavioral1/files/0x005e000000010323-17.dat family_neshta behavioral1/memory/2088-31-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/844-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2688-45-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1520-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2940-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2816-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2888-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2160-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d7-100.dat family_neshta behavioral1/files/0x000100000000f82d-129.dat family_neshta behavioral1/memory/352-140-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1464-139-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1344-159-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1604-158-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2448-175-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2176-173-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1724-187-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/784-203-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/960-202-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1704-230-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2944-229-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/880-242-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2360-240-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2972-256-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1588-255-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2664-264-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/844-279-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2768-278-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2860-287-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2856-286-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2816-295-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2852-294-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2780-303-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2888-302-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2612-311-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2692-310-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/768-319-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1840-318-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1632-326-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1492-327-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3016-335-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1684-334-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1948-343-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2396-342-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2344-263-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2840-350-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2640-351-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2648-359-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1800-358-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1696-367-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1692-366-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1768-186-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1100-375-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1952-374-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f871-131.dat family_neshta behavioral1/files/0x000100000000f82c-128.dat family_neshta behavioral1/memory/1268-383-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1768-382-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2544 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe 2088 svchost.com 844 06D906~1.EXE 1520 svchost.com 2688 06D906~1.EXE 2816 svchost.com 2940 06D906~1.EXE 2160 svchost.com 2888 06D906~1.EXE 2628 svchost.com 2652 06D906~1.EXE 2872 svchost.com 1544 06D906~1.EXE 352 svchost.com 1464 06D906~1.EXE 1344 svchost.com 1604 06D906~1.EXE 2448 svchost.com 2176 06D906~1.EXE 1768 svchost.com 1724 06D906~1.EXE 784 svchost.com 960 06D906~1.EXE 1704 svchost.com 2944 06D906~1.EXE 2360 svchost.com 880 06D906~1.EXE 2972 svchost.com 1588 06D906~1.EXE 2344 svchost.com 2664 06D906~1.EXE 844 svchost.com 2768 06D906~1.EXE 2860 svchost.com 2856 06D906~1.EXE 2816 svchost.com 2852 06D906~1.EXE 2780 svchost.com 2888 06D906~1.EXE 2612 svchost.com 2692 06D906~1.EXE 768 svchost.com 1840 06D906~1.EXE 1492 svchost.com 1632 06D906~1.EXE 3016 svchost.com 1684 06D906~1.EXE 1948 svchost.com 2396 06D906~1.EXE 2840 svchost.com 2640 06D906~1.EXE 2648 svchost.com 1800 06D906~1.EXE 1696 svchost.com 1692 06D906~1.EXE 1100 svchost.com 1952 06D906~1.EXE 1268 svchost.com 1768 06D906~1.EXE 696 svchost.com 1892 06D906~1.EXE 2432 svchost.com 1836 06D906~1.EXE 2100 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2532 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe 2532 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe 2088 svchost.com 2088 svchost.com 1520 svchost.com 1520 svchost.com 2816 svchost.com 2816 svchost.com 2160 svchost.com 2160 svchost.com 2628 svchost.com 2628 svchost.com 2872 svchost.com 2872 svchost.com 352 svchost.com 2544 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe 352 svchost.com 2544 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe 2532 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe 2544 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe 1344 svchost.com 1344 svchost.com 2448 svchost.com 2448 svchost.com 1768 svchost.com 1768 svchost.com 2532 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe 784 svchost.com 784 svchost.com 1704 svchost.com 1704 svchost.com 2532 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe 2360 svchost.com 2360 svchost.com 2972 svchost.com 2972 svchost.com 2344 svchost.com 2344 svchost.com 844 svchost.com 844 svchost.com 2860 svchost.com 2860 svchost.com 2816 svchost.com 2816 svchost.com 2780 svchost.com 2780 svchost.com 2612 svchost.com 2612 svchost.com 768 svchost.com 768 svchost.com 1492 svchost.com 1492 svchost.com 3016 svchost.com 3016 svchost.com 1948 svchost.com 1948 svchost.com 2840 svchost.com 2840 svchost.com 2648 svchost.com 2648 svchost.com 1696 svchost.com 1696 svchost.com 1100 svchost.com 1100 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys 06D906~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 06D906~1.EXE File opened for modification C:\Windows\directx.sys 06D906~1.EXE File opened for modification C:\Windows\directx.sys 06D906~1.EXE File opened for modification C:\Windows\svchost.com 06D906~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 06D906~1.EXE File opened for modification C:\Windows\directx.sys 06D906~1.EXE File opened for modification C:\Windows\directx.sys 06D906~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 06D906~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 06D906~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 06D906~1.EXE File opened for modification C:\Windows\directx.sys 06D906~1.EXE File opened for modification C:\Windows\directx.sys 06D906~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 06D906~1.EXE File opened for modification C:\Windows\svchost.com 06D906~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 06D906~1.EXE File opened for modification C:\Windows\svchost.com 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 06D906~1.EXE File opened for modification C:\Windows\directx.sys 06D906~1.EXE File opened for modification C:\Windows\directx.sys 06D906~1.EXE File opened for modification C:\Windows\directx.sys 06D906~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 06D906~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe File opened for modification C:\Windows\svchost.com 06D906~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 06D906~1.EXE File opened for modification C:\Windows\directx.sys 06D906~1.EXE File opened for modification C:\Windows\svchost.com 06D906~1.EXE File opened for modification C:\Windows\svchost.com 06D906~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 06D906~1.EXE File opened for modification C:\Windows\svchost.com 06D906~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 06D906~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 06D906~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 06D906~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 06D906~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06D906~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2532 wrote to memory of 2544 2532 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe 30 PID 2532 wrote to memory of 2544 2532 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe 30 PID 2532 wrote to memory of 2544 2532 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe 30 PID 2532 wrote to memory of 2544 2532 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe 30 PID 2544 wrote to memory of 2088 2544 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe 31 PID 2544 wrote to memory of 2088 2544 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe 31 PID 2544 wrote to memory of 2088 2544 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe 31 PID 2544 wrote to memory of 2088 2544 06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe 31 PID 2088 wrote to memory of 844 2088 svchost.com 285 PID 2088 wrote to memory of 844 2088 svchost.com 285 PID 2088 wrote to memory of 844 2088 svchost.com 285 PID 2088 wrote to memory of 844 2088 svchost.com 285 PID 844 wrote to memory of 1520 844 06D906~1.EXE 411 PID 844 wrote to memory of 1520 844 06D906~1.EXE 411 PID 844 wrote to memory of 1520 844 06D906~1.EXE 411 PID 844 wrote to memory of 1520 844 06D906~1.EXE 411 PID 1520 wrote to memory of 2688 1520 svchost.com 34 PID 1520 wrote to memory of 2688 1520 svchost.com 34 PID 1520 wrote to memory of 2688 1520 svchost.com 34 PID 1520 wrote to memory of 2688 1520 svchost.com 34 PID 2688 wrote to memory of 2816 2688 06D906~1.EXE 330 PID 2688 wrote to memory of 2816 2688 06D906~1.EXE 330 PID 2688 wrote to memory of 2816 2688 06D906~1.EXE 330 PID 2688 wrote to memory of 2816 2688 06D906~1.EXE 330 PID 2816 wrote to memory of 2940 2816 svchost.com 113 PID 2816 wrote to memory of 2940 2816 svchost.com 113 PID 2816 wrote to memory of 2940 2816 svchost.com 113 PID 2816 wrote to memory of 2940 2816 svchost.com 113 PID 2940 wrote to memory of 2160 2940 06D906~1.EXE 420 PID 2940 wrote to memory of 2160 2940 06D906~1.EXE 420 PID 2940 wrote to memory of 2160 2940 06D906~1.EXE 420 PID 2940 wrote to memory of 2160 2940 06D906~1.EXE 420 PID 2160 wrote to memory of 2888 2160 svchost.com 38 PID 2160 wrote to memory of 2888 2160 svchost.com 38 PID 2160 wrote to memory of 2888 2160 svchost.com 38 PID 2160 wrote to memory of 2888 2160 svchost.com 38 PID 2888 wrote to memory of 2628 2888 06D906~1.EXE 159 PID 2888 wrote to memory of 2628 2888 06D906~1.EXE 159 PID 2888 wrote to memory of 2628 2888 06D906~1.EXE 159 PID 2888 wrote to memory of 2628 2888 06D906~1.EXE 159 PID 2628 wrote to memory of 2652 2628 svchost.com 335 PID 2628 wrote to memory of 2652 2628 svchost.com 335 PID 2628 wrote to memory of 2652 2628 svchost.com 335 PID 2628 wrote to memory of 2652 2628 svchost.com 335 PID 2652 wrote to memory of 2872 2652 06D906~1.EXE 382 PID 2652 wrote to memory of 2872 2652 06D906~1.EXE 382 PID 2652 wrote to memory of 2872 2652 06D906~1.EXE 382 PID 2652 wrote to memory of 2872 2652 06D906~1.EXE 382 PID 2872 wrote to memory of 1544 2872 svchost.com 432 PID 2872 wrote to memory of 1544 2872 svchost.com 432 PID 2872 wrote to memory of 1544 2872 svchost.com 432 PID 2872 wrote to memory of 1544 2872 svchost.com 432 PID 1544 wrote to memory of 352 1544 06D906~1.EXE 297 PID 1544 wrote to memory of 352 1544 06D906~1.EXE 297 PID 1544 wrote to memory of 352 1544 06D906~1.EXE 297 PID 1544 wrote to memory of 352 1544 06D906~1.EXE 297 PID 352 wrote to memory of 1464 352 svchost.com 342 PID 352 wrote to memory of 1464 352 svchost.com 342 PID 352 wrote to memory of 1464 352 svchost.com 342 PID 352 wrote to memory of 1464 352 svchost.com 342 PID 1464 wrote to memory of 1344 1464 06D906~1.EXE 217 PID 1464 wrote to memory of 1344 1464 06D906~1.EXE 217 PID 1464 wrote to memory of 1344 1464 06D906~1.EXE 217 PID 1464 wrote to memory of 1344 1464 06D906~1.EXE 217
Processes
-
C:\Users\Admin\AppData\Local\Temp\06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe"C:\Users\Admin\AppData\Local\Temp\06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\06d906c884cf44d070af9b37f1eb630e3f4d4d51965051c977308dae53a7ee13N.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:352 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1604 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE20⤵
- Executes dropped EXE
PID:2176 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE22⤵
- Executes dropped EXE
PID:1724 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:784 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE24⤵
- Executes dropped EXE
PID:960 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE26⤵
- Executes dropped EXE
PID:2944 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE28⤵
- Executes dropped EXE
PID:880 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE30⤵
- Executes dropped EXE
PID:1588 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE32⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2664 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE34⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2768 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE36⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2856 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE38⤵
- Executes dropped EXE
PID:2852 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE40⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2888 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE42⤵
- Executes dropped EXE
PID:2692 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE44⤵
- Executes dropped EXE
PID:1840 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE46⤵
- Executes dropped EXE
PID:1632 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE48⤵
- Executes dropped EXE
PID:1684 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE50⤵
- Executes dropped EXE
PID:2396 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE52⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2640 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE54⤵
- Executes dropped EXE
PID:1800 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE56⤵
- Executes dropped EXE
PID:1692 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1952 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"59⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE60⤵
- Executes dropped EXE
PID:1768 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"61⤵
- Executes dropped EXE
PID:696 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE62⤵
- Executes dropped EXE
PID:1892 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"63⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE64⤵
- Executes dropped EXE
PID:1836 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE66⤵
- System Location Discovery: System Language Discovery
PID:1448 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"67⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE68⤵PID:1412
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"69⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE70⤵
- System Location Discovery: System Language Discovery
PID:2300 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"71⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE72⤵PID:2928
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"73⤵
- System Location Discovery: System Language Discovery
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE74⤵PID:2084
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"75⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE76⤵
- Drops file in Windows directory
PID:2248 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"77⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE78⤵PID:2724
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"79⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE80⤵PID:2804
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"81⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE82⤵PID:2696
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"83⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE84⤵PID:2644
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"85⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE86⤵
- Drops file in Windows directory
PID:2652 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"87⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE88⤵PID:1620
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"89⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE90⤵PID:2488
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"91⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE92⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1340 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"93⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE94⤵
- System Location Discovery: System Language Discovery
PID:1072 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"95⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE96⤵PID:2676
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"97⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE98⤵
- Drops file in Windows directory
PID:1356 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"99⤵
- Drops file in Windows directory
PID:604 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE100⤵PID:2256
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"101⤵
- Drops file in Windows directory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE102⤵PID:300
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"103⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE104⤵PID:1952
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"105⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE106⤵PID:952
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"107⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE108⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1284 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"109⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE110⤵PID:3068
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"111⤵
- Drops file in Windows directory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE112⤵PID:1888
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"113⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE114⤵
- Drops file in Windows directory
PID:888 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"115⤵
- System Location Discovery: System Language Discovery
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE116⤵PID:1508
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"117⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE118⤵
- Drops file in Windows directory
PID:1076 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"119⤵
- System Location Discovery: System Language Discovery
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE120⤵PID:324
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\06D906~1.EXE"121⤵PID:2164
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-