Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30-11-2024 04:28
Behavioral task
behavioral1
Sample
253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
120 seconds
General
-
Target
253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe
-
Size
272KB
-
MD5
2447acad63ef16345beabd063b41e360
-
SHA1
4d3a3a7c723e15dcfd1f7ee01c6ce6b54dd341b6
-
SHA256
253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4
-
SHA512
ff4e18d826844d267678ce461aabe7bf567e2311089606ddd73afb8d9470a0e11dfe42cf06f1bb225521ab30ca693d7330b16c9ab9d1dfdae2f7b365a8a25d4e
-
SSDEEP
3072:sr85Ce9PhKtkbecpt6vIlCSMF0t+elnhP2rCRr85C:k9eTKKbJ6vIlMxe/+Ct9
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0008000000016d06-9.dat family_neshta behavioral1/files/0x0008000000016d0e-20.dat family_neshta behavioral1/files/0x001400000000f841-16.dat family_neshta behavioral1/files/0x0001000000010314-19.dat family_neshta behavioral1/files/0x0001000000010312-18.dat family_neshta behavioral1/files/0x0001000000010738-17.dat family_neshta behavioral1/memory/2380-29-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2372-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2716-43-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2224-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2792-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1628-57-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2860-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2160-71-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2568-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1244-85-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2276-100-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2824-99-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d8-114.dat family_neshta behavioral1/memory/2832-121-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7ca-126.dat family_neshta behavioral1/files/0x000100000000f7e6-127.dat family_neshta behavioral1/files/0x000100000000f776-125.dat family_neshta behavioral1/memory/2100-122-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1460-143-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/980-144-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2956-158-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2252-160-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1876-178-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/584-179-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1096-197-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2900-196-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1384-209-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2152-210-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1528-224-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/960-223-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2404-249-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1708-251-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/864-263-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2488-262-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1560-271-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1712-270-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2280-290-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2380-289-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2692-301-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2724-302-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2864-310-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2596-309-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2680-317-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1960-318-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2588-325-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2740-326-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2860-334-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2156-333-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1820-342-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2556-341-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2472-349-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/264-350-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/588-357-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1848-358-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1948-365-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1348-366-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2184-374-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/980-373-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2228 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe 2372 svchost.com 2380 253CB1~1.EXE 2224 svchost.com 2716 253CB1~1.EXE 2792 svchost.com 1628 253CB1~1.EXE 2160 svchost.com 2860 253CB1~1.EXE 2568 svchost.com 1244 253CB1~1.EXE 2276 svchost.com 2824 253CB1~1.EXE 2832 svchost.com 2100 253CB1~1.EXE 980 svchost.com 1460 253CB1~1.EXE 2252 svchost.com 2956 253CB1~1.EXE 584 svchost.com 1876 253CB1~1.EXE 1096 svchost.com 2900 253CB1~1.EXE 2152 svchost.com 1384 253CB1~1.EXE 960 svchost.com 1528 253CB1~1.EXE 1708 svchost.com 2404 253CB1~1.EXE 864 svchost.com 2488 253CB1~1.EXE 1560 svchost.com 1712 253CB1~1.EXE 2280 svchost.com 2380 253CB1~1.EXE 2724 svchost.com 2692 253CB1~1.EXE 2864 svchost.com 2596 253CB1~1.EXE 1960 svchost.com 2680 253CB1~1.EXE 2740 svchost.com 2588 253CB1~1.EXE 2860 svchost.com 2156 253CB1~1.EXE 1820 svchost.com 2556 253CB1~1.EXE 264 svchost.com 2472 253CB1~1.EXE 1848 svchost.com 588 253CB1~1.EXE 1348 svchost.com 1948 253CB1~1.EXE 2184 svchost.com 980 253CB1~1.EXE 1460 svchost.com 2140 253CB1~1.EXE 2148 svchost.com 2176 253CB1~1.EXE 1484 svchost.com 1664 253CB1~1.EXE 2500 svchost.com 1876 253CB1~1.EXE 1372 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2356 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe 2356 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe 2372 svchost.com 2372 svchost.com 2224 svchost.com 2224 svchost.com 2792 svchost.com 2792 svchost.com 2160 svchost.com 2160 svchost.com 2568 svchost.com 2568 svchost.com 2276 svchost.com 2276 svchost.com 2832 svchost.com 2832 svchost.com 2228 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe 2356 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe 2356 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe 980 svchost.com 980 svchost.com 2252 svchost.com 2252 svchost.com 584 svchost.com 2356 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe 584 svchost.com 1096 svchost.com 1096 svchost.com 2356 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe 2152 svchost.com 2152 svchost.com 960 svchost.com 960 svchost.com 2356 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe 1708 svchost.com 1708 svchost.com 2228 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe 864 svchost.com 864 svchost.com 1560 svchost.com 1560 svchost.com 2280 svchost.com 2280 svchost.com 2724 svchost.com 2724 svchost.com 2864 svchost.com 2864 svchost.com 1960 svchost.com 1960 svchost.com 2740 svchost.com 2740 svchost.com 2860 svchost.com 2860 svchost.com 1820 svchost.com 1820 svchost.com 264 svchost.com 264 svchost.com 1848 svchost.com 1848 svchost.com 1348 svchost.com 1348 svchost.com 2184 svchost.com 2184 svchost.com 1460 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 253CB1~1.EXE File opened for modification C:\Windows\svchost.com 253CB1~1.EXE File opened for modification C:\Windows\directx.sys 253CB1~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 253CB1~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 253CB1~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 253CB1~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 253CB1~1.EXE File opened for modification C:\Windows\svchost.com 253CB1~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 253CB1~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 253CB1~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 253CB1~1.EXE File opened for modification C:\Windows\directx.sys 253CB1~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 253CB1~1.EXE File opened for modification C:\Windows\svchost.com 253CB1~1.EXE File opened for modification C:\Windows\svchost.com 253CB1~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 253CB1~1.EXE File opened for modification C:\Windows\svchost.com 253CB1~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 253CB1~1.EXE File opened for modification C:\Windows\directx.sys 253CB1~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 253CB1~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 253CB1~1.EXE File opened for modification C:\Windows\directx.sys 253CB1~1.EXE File opened for modification C:\Windows\svchost.com 253CB1~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 253CB1~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 253CB1~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253CB1~1.EXE -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2228 2356 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe 30 PID 2356 wrote to memory of 2228 2356 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe 30 PID 2356 wrote to memory of 2228 2356 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe 30 PID 2356 wrote to memory of 2228 2356 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe 30 PID 2228 wrote to memory of 2372 2228 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe 31 PID 2228 wrote to memory of 2372 2228 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe 31 PID 2228 wrote to memory of 2372 2228 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe 31 PID 2228 wrote to memory of 2372 2228 253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe 31 PID 2372 wrote to memory of 2380 2372 svchost.com 32 PID 2372 wrote to memory of 2380 2372 svchost.com 32 PID 2372 wrote to memory of 2380 2372 svchost.com 32 PID 2372 wrote to memory of 2380 2372 svchost.com 32 PID 2380 wrote to memory of 2224 2380 253CB1~1.EXE 33 PID 2380 wrote to memory of 2224 2380 253CB1~1.EXE 33 PID 2380 wrote to memory of 2224 2380 253CB1~1.EXE 33 PID 2380 wrote to memory of 2224 2380 253CB1~1.EXE 33 PID 2224 wrote to memory of 2716 2224 svchost.com 34 PID 2224 wrote to memory of 2716 2224 svchost.com 34 PID 2224 wrote to memory of 2716 2224 svchost.com 34 PID 2224 wrote to memory of 2716 2224 svchost.com 34 PID 2716 wrote to memory of 2792 2716 253CB1~1.EXE 35 PID 2716 wrote to memory of 2792 2716 253CB1~1.EXE 35 PID 2716 wrote to memory of 2792 2716 253CB1~1.EXE 35 PID 2716 wrote to memory of 2792 2716 253CB1~1.EXE 35 PID 2792 wrote to memory of 1628 2792 svchost.com 36 PID 2792 wrote to memory of 1628 2792 svchost.com 36 PID 2792 wrote to memory of 1628 2792 svchost.com 36 PID 2792 wrote to memory of 1628 2792 svchost.com 36 PID 1628 wrote to memory of 2160 1628 253CB1~1.EXE 37 PID 1628 wrote to memory of 2160 1628 253CB1~1.EXE 37 PID 1628 wrote to memory of 2160 1628 253CB1~1.EXE 37 PID 1628 wrote to memory of 2160 1628 253CB1~1.EXE 37 PID 2160 wrote to memory of 2860 2160 svchost.com 73 PID 2160 wrote to memory of 2860 2160 svchost.com 73 PID 2160 wrote to memory of 2860 2160 svchost.com 73 PID 2160 wrote to memory of 2860 2160 svchost.com 73 PID 2860 wrote to memory of 2568 2860 253CB1~1.EXE 39 PID 2860 wrote to memory of 2568 2860 253CB1~1.EXE 39 PID 2860 wrote to memory of 2568 2860 253CB1~1.EXE 39 PID 2860 wrote to memory of 2568 2860 253CB1~1.EXE 39 PID 2568 wrote to memory of 1244 2568 svchost.com 40 PID 2568 wrote to memory of 1244 2568 svchost.com 40 PID 2568 wrote to memory of 1244 2568 svchost.com 40 PID 2568 wrote to memory of 1244 2568 svchost.com 40 PID 1244 wrote to memory of 2276 1244 253CB1~1.EXE 41 PID 1244 wrote to memory of 2276 1244 253CB1~1.EXE 41 PID 1244 wrote to memory of 2276 1244 253CB1~1.EXE 41 PID 1244 wrote to memory of 2276 1244 253CB1~1.EXE 41 PID 2276 wrote to memory of 2824 2276 svchost.com 128 PID 2276 wrote to memory of 2824 2276 svchost.com 128 PID 2276 wrote to memory of 2824 2276 svchost.com 128 PID 2276 wrote to memory of 2824 2276 svchost.com 128 PID 2824 wrote to memory of 2832 2824 253CB1~1.EXE 43 PID 2824 wrote to memory of 2832 2824 253CB1~1.EXE 43 PID 2824 wrote to memory of 2832 2824 253CB1~1.EXE 43 PID 2824 wrote to memory of 2832 2824 253CB1~1.EXE 43 PID 2832 wrote to memory of 2100 2832 svchost.com 44 PID 2832 wrote to memory of 2100 2832 svchost.com 44 PID 2832 wrote to memory of 2100 2832 svchost.com 44 PID 2832 wrote to memory of 2100 2832 svchost.com 44 PID 2100 wrote to memory of 980 2100 253CB1~1.EXE 84 PID 2100 wrote to memory of 980 2100 253CB1~1.EXE 84 PID 2100 wrote to memory of 980 2100 253CB1~1.EXE 84 PID 2100 wrote to memory of 980 2100 253CB1~1.EXE 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe"C:\Users\Admin\AppData\Local\Temp\253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\253cb105af7690b20b94893ac29fdfc0dfa718a1166be68c08820efce3aa84b4N.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE8⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:980 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE18⤵
- Executes dropped EXE
PID:1460 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE20⤵
- Executes dropped EXE
PID:2956 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:584 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE22⤵
- Executes dropped EXE
PID:1876 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2900 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE26⤵
- Executes dropped EXE
PID:1384 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE28⤵
- Executes dropped EXE
PID:1528 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE30⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2404 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:864 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE32⤵
- Executes dropped EXE
PID:2488 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1712 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE36⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2380 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE38⤵
- Executes dropped EXE
PID:2692 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE40⤵
- Executes dropped EXE
PID:2596 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2680 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE44⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2588 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE46⤵
- Executes dropped EXE
PID:2156 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE48⤵
- Executes dropped EXE
PID:2556 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:264 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE50⤵
- Executes dropped EXE
PID:2472 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE52⤵
- Executes dropped EXE
PID:588 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE54⤵
- Executes dropped EXE
PID:1948 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE56⤵
- Executes dropped EXE
PID:980 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE58⤵
- Executes dropped EXE
PID:2140 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"59⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2176 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE62⤵
- Executes dropped EXE
PID:1664 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"63⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE64⤵
- Executes dropped EXE
PID:1876 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"65⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE66⤵PID:2068
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"67⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE68⤵
- System Location Discovery: System Language Discovery
PID:1672 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"69⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE70⤵PID:916
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"71⤵
- Drops file in Windows directory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE72⤵PID:1868
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"73⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE74⤵
- System Location Discovery: System Language Discovery
PID:2192 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"75⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE76⤵PID:1800
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"77⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE78⤵PID:2984
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"79⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE80⤵
- System Location Discovery: System Language Discovery
PID:864 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"81⤵
- Drops file in Windows directory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE82⤵PID:1428
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"83⤵
- System Location Discovery: System Language Discovery
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE84⤵
- System Location Discovery: System Language Discovery
PID:2884 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"85⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE86⤵
- Drops file in Windows directory
PID:2380 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"87⤵
- System Location Discovery: System Language Discovery
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE88⤵PID:2660
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"89⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE90⤵PID:2756
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"91⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE92⤵PID:2784
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"93⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE94⤵
- Drops file in Windows directory
PID:2740 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"95⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE96⤵PID:2860
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"97⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:316 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE98⤵PID:3060
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"99⤵
- Drops file in Windows directory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE100⤵PID:2824
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"101⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE102⤵PID:2628
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"103⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE104⤵PID:1348
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"105⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE106⤵PID:2908
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"107⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE108⤵PID:2140
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"109⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE110⤵PID:2264
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"111⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE112⤵PID:1880
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"113⤵
- System Location Discovery: System Language Discovery
PID:492 -
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE114⤵PID:868
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"115⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE116⤵
- System Location Discovery: System Language Discovery
PID:1496 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"117⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE118⤵PID:928
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"119⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE120⤵
- System Location Discovery: System Language Discovery
PID:1384 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\253CB1~1.EXE"121⤵PID:1988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-